Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 1 | /* |
Florin Coras | c9940fc | 2019-02-05 20:55:11 -0800 | [diff] [blame] | 2 | * Copyright (c) 2018-2019 Cisco and/or its affiliates. |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
| 15 | |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 16 | #include <vnet/session/application_interface.h> |
Florin Coras | c1a4265 | 2019-02-08 18:27:29 -0800 | [diff] [blame] | 17 | #include <vnet/session/application.h> |
Florin Coras | c9940fc | 2019-02-05 20:55:11 -0800 | [diff] [blame] | 18 | #include <vnet/session/session.h> |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 19 | #include <vppinfra/lock.h> |
| 20 | |
| 21 | #ifndef SRC_VNET_TLS_TLS_H_ |
| 22 | #define SRC_VNET_TLS_TLS_H_ |
| 23 | |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 24 | #define TLS_DEBUG 0 |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 25 | #define TLS_DEBUG_LEVEL_CLIENT 0 |
| 26 | #define TLS_DEBUG_LEVEL_SERVER 0 |
| 27 | |
| 28 | #define TLS_CHUNK_SIZE (1 << 14) |
| 29 | #define TLS_CA_CERT_PATH "/etc/ssl/certs/ca-certificates.crt" |
| 30 | |
| 31 | #if TLS_DEBUG |
| 32 | #define TLS_DBG(_lvl, _fmt, _args...) \ |
| 33 | if (_lvl <= TLS_DEBUG) \ |
| 34 | clib_warning (_fmt, ##_args) |
| 35 | #else |
Ping Yu | 970a0b8 | 2018-07-19 10:51:09 -0400 | [diff] [blame] | 36 | #define TLS_DBG(_lvl, _fmt, _args...) |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 37 | #endif |
| 38 | |
| 39 | /* *INDENT-OFF* */ |
Florin Coras | 854e0a2 | 2019-07-26 14:46:12 -0700 | [diff] [blame] | 40 | typedef struct tls_cxt_id_ |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 41 | { |
Florin Coras | 58a93e8 | 2019-01-14 23:33:46 -0800 | [diff] [blame] | 42 | union { |
| 43 | session_handle_t app_session_handle; |
| 44 | u32 parent_app_api_ctx; |
| 45 | }; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 46 | session_handle_t tls_session_handle; |
Florin Coras | 854e0a2 | 2019-07-26 14:46:12 -0700 | [diff] [blame] | 47 | u32 parent_app_wrk_index; |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 48 | u32 ssl_ctx; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 49 | u32 listener_ctx_index; |
| 50 | u8 tcp_is_ip4; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 51 | u8 tls_engine_id; |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 52 | void *migrate_ctx; |
Florin Coras | 854e0a2 | 2019-07-26 14:46:12 -0700 | [diff] [blame] | 53 | } tls_ctx_id_t; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 54 | /* *INDENT-ON* */ |
| 55 | |
Florin Coras | 854e0a2 | 2019-07-26 14:46:12 -0700 | [diff] [blame] | 56 | STATIC_ASSERT (sizeof (tls_ctx_id_t) <= TRANSPORT_CONN_ID_LEN, |
| 57 | "ctx id must be less than TRANSPORT_CONN_ID_LEN"); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 58 | |
| 59 | typedef struct tls_ctx_ |
| 60 | { |
| 61 | union |
| 62 | { |
| 63 | transport_connection_t connection; |
| 64 | tls_ctx_id_t c_tls_ctx_id; |
| 65 | }; |
Florin Coras | df57ea0 | 2019-02-18 20:14:20 -0800 | [diff] [blame] | 66 | #define parent_app_wrk_index c_tls_ctx_id.parent_app_wrk_index |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 67 | #define app_session_handle c_tls_ctx_id.app_session_handle |
| 68 | #define tls_session_handle c_tls_ctx_id.tls_session_handle |
| 69 | #define listener_ctx_index c_tls_ctx_id.listener_ctx_index |
| 70 | #define tcp_is_ip4 c_tls_ctx_id.tcp_is_ip4 |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 71 | #define tls_ctx_engine c_tls_ctx_id.tls_engine_id |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 72 | #define tls_ssl_ctx c_tls_ctx_id.ssl_ctx |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 73 | #define tls_ctx_handle c_c_index |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 74 | /* Temporary storage for session open opaque. Overwritten once |
| 75 | * underlying tcp connection is established */ |
Florin Coras | 58a93e8 | 2019-01-14 23:33:46 -0800 | [diff] [blame] | 76 | #define parent_app_api_context c_tls_ctx_id.parent_app_api_ctx |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 77 | #define migration_ctx c_tls_ctx_id.migrate_ctx |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 78 | |
| 79 | u8 is_passive_close; |
Ping Yu | e43832c | 2018-05-30 18:16:08 -0400 | [diff] [blame] | 80 | u8 resume; |
Florin Coras | ef2b335 | 2019-08-07 11:14:56 -0700 | [diff] [blame] | 81 | u8 app_closed; |
| 82 | u8 no_app_session; |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 83 | u8 is_migrated; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 84 | u8 *srv_hostname; |
Yu Ping | f4a92f6 | 2020-01-21 05:07:30 +0800 | [diff] [blame] | 85 | u32 evt_index; |
Nathan Skrzypczak | 79f8953 | 2019-09-13 11:08:13 +0200 | [diff] [blame] | 86 | u32 ckpair_index; |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 87 | transport_proto_t tls_type; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 88 | } tls_ctx_t; |
| 89 | |
| 90 | typedef struct tls_main_ |
| 91 | { |
| 92 | u32 app_index; |
| 93 | tls_ctx_t *listener_ctx_pool; |
| 94 | tls_ctx_t *half_open_ctx_pool; |
| 95 | clib_rwlock_t half_open_rwlock; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 96 | u8 **rx_bufs; |
| 97 | u8 **tx_bufs; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 98 | |
| 99 | /* |
| 100 | * Config |
| 101 | */ |
| 102 | u8 use_test_cert_in_ca; |
| 103 | char *ca_cert_path; |
Florin Coras | ddd98f3 | 2019-03-25 08:30:53 -0700 | [diff] [blame] | 104 | u64 first_seg_size; |
| 105 | u32 fifo_size; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 106 | } tls_main_t; |
| 107 | |
| 108 | typedef struct tls_engine_vft_ |
| 109 | { |
| 110 | u32 (*ctx_alloc) (void); |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 111 | u32 (*ctx_alloc_w_thread) (u32 thread_index); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 112 | void (*ctx_free) (tls_ctx_t * ctx); |
Florin Coras | 4b47ee2 | 2020-11-19 13:38:26 -0800 | [diff] [blame^] | 113 | void *(*ctx_detach) (tls_ctx_t *ctx); |
| 114 | u32 (*ctx_attach) (u32 thread_index, void *ctx); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 115 | tls_ctx_t *(*ctx_get) (u32 ctx_index); |
| 116 | tls_ctx_t *(*ctx_get_w_thread) (u32 ctx_index, u8 thread_index); |
| 117 | int (*ctx_init_client) (tls_ctx_t * ctx); |
| 118 | int (*ctx_init_server) (tls_ctx_t * ctx); |
Florin Coras | 288eaab | 2019-02-03 15:26:14 -0800 | [diff] [blame] | 119 | int (*ctx_read) (tls_ctx_t * ctx, session_t * tls_session); |
Florin Coras | 9f86d22 | 2020-03-23 15:34:22 +0000 | [diff] [blame] | 120 | int (*ctx_write) (tls_ctx_t * ctx, session_t * app_session, |
| 121 | transport_send_params_t * sp); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 122 | u8 (*ctx_handshake_is_over) (tls_ctx_t * ctx); |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 123 | int (*ctx_start_listen) (tls_ctx_t * ctx); |
| 124 | int (*ctx_stop_listen) (tls_ctx_t * ctx); |
Florin Coras | 06a6a30 | 2019-04-17 14:19:12 -0700 | [diff] [blame] | 125 | int (*ctx_transport_close) (tls_ctx_t * ctx); |
| 126 | int (*ctx_app_close) (tls_ctx_t * ctx); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 127 | } tls_engine_vft_t; |
| 128 | |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 129 | tls_main_t *vnet_tls_get_main (void); |
| 130 | void tls_register_engine (const tls_engine_vft_t * vft, |
Nathan Skrzypczak | 82fc5fd | 2019-09-13 10:20:15 +0200 | [diff] [blame] | 131 | crypto_engine_type_t type); |
Florin Coras | 288eaab | 2019-02-03 15:26:14 -0800 | [diff] [blame] | 132 | int tls_add_vpp_q_rx_evt (session_t * s); |
| 133 | int tls_add_vpp_q_tx_evt (session_t * s); |
| 134 | int tls_add_vpp_q_builtin_tx_evt (session_t * s); |
| 135 | int tls_add_vpp_q_builtin_rx_evt (session_t * s); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 136 | int tls_notify_app_accept (tls_ctx_t * ctx); |
Florin Coras | 00e01d3 | 2019-10-21 16:07:46 -0700 | [diff] [blame] | 137 | int tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err); |
Florin Coras | 288eaab | 2019-02-03 15:26:14 -0800 | [diff] [blame] | 138 | void tls_notify_app_enqueue (tls_ctx_t * ctx, session_t * app_session); |
Florin Coras | 06a6a30 | 2019-04-17 14:19:12 -0700 | [diff] [blame] | 139 | void tls_disconnect_transport (tls_ctx_t * ctx); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 140 | #endif /* SRC_VNET_TLS_TLS_H_ */ |
Florin Coras | 54a51fd | 2019-02-07 15:34:52 -0800 | [diff] [blame] | 141 | |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 142 | /* |
| 143 | * fd.io coding-style-patch-verification: ON |
| 144 | * |
| 145 | * Local Variables: |
| 146 | * eval: (c-set-style "gnu") |
| 147 | * End: |
| 148 | */ |