Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2018 Cisco and/or its affiliates. |
| 3 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | * you may not use this file except in compliance with the License. |
| 5 | * You may obtain a copy of the License at: |
| 6 | * |
| 7 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | * |
| 9 | * Unless required by applicable law or agreed to in writing, software |
| 10 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | * See the License for the specific language governing permissions and |
| 13 | * limitations under the License. |
| 14 | */ |
| 15 | |
| 16 | #include <vnet/session/application_interface.h> |
| 17 | #include <vppinfra/lock.h> |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 18 | #include <vnet/tls/tls.h> |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 19 | |
| 20 | static tls_main_t tls_main; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 21 | static tls_engine_vft_t *tls_vfts; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 22 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 23 | #define TLS_INVALID_HANDLE ~0 |
| 24 | #define TLS_IDX_MASK 0x00FFFFFF |
| 25 | #define TLS_ENGINE_TYPE_SHIFT 29 |
| 26 | |
| 27 | void tls_disconnect (u32 ctx_handle, u32 thread_index); |
| 28 | |
Florin Coras | c01d578 | 2018-10-17 14:53:11 -0700 | [diff] [blame] | 29 | static void |
| 30 | tls_disconnect_transport (tls_ctx_t * ctx) |
| 31 | { |
| 32 | vnet_disconnect_args_t a = { |
| 33 | .handle = ctx->tls_session_handle, |
| 34 | .app_index = tls_main.app_index, |
| 35 | }; |
| 36 | |
| 37 | if (vnet_disconnect_session (&a)) |
| 38 | clib_warning ("disconnect returned"); |
| 39 | } |
| 40 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 41 | tls_engine_type_t |
| 42 | tls_get_available_engine (void) |
| 43 | { |
| 44 | int i; |
| 45 | for (i = 0; i < vec_len (tls_vfts); i++) |
| 46 | { |
| 47 | if (tls_vfts[i].ctx_alloc) |
| 48 | return i; |
| 49 | } |
| 50 | return TLS_ENGINE_NONE; |
| 51 | } |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 52 | |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 53 | int |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 54 | tls_add_vpp_q_rx_evt (stream_session_t * s) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 55 | { |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 56 | if (svm_fifo_set_event (s->server_rx_fifo)) |
| 57 | session_send_io_evt_to_thread (s->server_rx_fifo, FIFO_EVENT_APP_RX); |
| 58 | return 0; |
| 59 | } |
| 60 | |
| 61 | int |
| 62 | tls_add_vpp_q_builtin_rx_evt (stream_session_t * s) |
| 63 | { |
| 64 | if (svm_fifo_set_event (s->server_rx_fifo)) |
| 65 | session_send_io_evt_to_thread (s->server_rx_fifo, FIFO_EVENT_BUILTIN_RX); |
| 66 | return 0; |
| 67 | } |
| 68 | |
| 69 | int |
| 70 | tls_add_vpp_q_tx_evt (stream_session_t * s) |
| 71 | { |
| 72 | if (svm_fifo_set_event (s->server_tx_fifo)) |
| 73 | session_send_io_evt_to_thread (s->server_tx_fifo, FIFO_EVENT_APP_TX); |
| 74 | return 0; |
| 75 | } |
| 76 | |
| 77 | int |
| 78 | tls_add_vpp_q_builtin_tx_evt (stream_session_t * s) |
| 79 | { |
| 80 | if (svm_fifo_set_event (s->server_tx_fifo)) |
| 81 | session_send_io_evt_to_thread_custom (s, s->thread_index, |
| 82 | FIFO_EVENT_BUILTIN_TX); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 83 | return 0; |
| 84 | } |
| 85 | |
| 86 | static inline int |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 87 | tls_add_app_q_evt (app_worker_t * app, stream_session_t * app_session) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 88 | { |
Florin Coras | 2179513 | 2018-09-09 09:40:51 -0700 | [diff] [blame] | 89 | return app_worker_lock_and_send_event (app, app_session, FIFO_EVENT_APP_RX); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 90 | } |
| 91 | |
| 92 | u32 |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 93 | tls_listener_ctx_alloc (void) |
| 94 | { |
| 95 | tls_main_t *tm = &tls_main; |
| 96 | tls_ctx_t *ctx; |
| 97 | |
| 98 | pool_get (tm->listener_ctx_pool, ctx); |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 99 | clib_memset (ctx, 0, sizeof (*ctx)); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 100 | return ctx - tm->listener_ctx_pool; |
| 101 | } |
| 102 | |
| 103 | void |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 104 | tls_listener_ctx_free (tls_ctx_t * ctx) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 105 | { |
Florin Coras | c01d578 | 2018-10-17 14:53:11 -0700 | [diff] [blame] | 106 | if (CLIB_DEBUG) |
| 107 | memset (ctx, 0xfb, sizeof (*ctx)); |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 108 | pool_put (tls_main.listener_ctx_pool, ctx); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 109 | } |
| 110 | |
| 111 | tls_ctx_t * |
| 112 | tls_listener_ctx_get (u32 ctx_index) |
| 113 | { |
| 114 | return pool_elt_at_index (tls_main.listener_ctx_pool, ctx_index); |
| 115 | } |
| 116 | |
| 117 | u32 |
| 118 | tls_listener_ctx_index (tls_ctx_t * ctx) |
| 119 | { |
| 120 | return (ctx - tls_main.listener_ctx_pool); |
| 121 | } |
| 122 | |
| 123 | u32 |
| 124 | tls_ctx_half_open_alloc (void) |
| 125 | { |
| 126 | tls_main_t *tm = &tls_main; |
| 127 | u8 will_expand = 0; |
| 128 | tls_ctx_t *ctx; |
| 129 | u32 ctx_index; |
| 130 | |
| 131 | pool_get_aligned_will_expand (tm->half_open_ctx_pool, will_expand, 0); |
| 132 | if (PREDICT_FALSE (will_expand && vlib_num_workers ())) |
| 133 | { |
| 134 | clib_rwlock_writer_lock (&tm->half_open_rwlock); |
| 135 | pool_get (tm->half_open_ctx_pool, ctx); |
Florin Coras | eb97e5f | 2018-10-15 21:35:42 -0700 | [diff] [blame] | 136 | ctx_index = ctx - tm->half_open_ctx_pool; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 137 | clib_rwlock_writer_unlock (&tm->half_open_rwlock); |
| 138 | } |
| 139 | else |
| 140 | { |
Ping Yu | e6446a3 | 2018-08-28 18:56:27 -0400 | [diff] [blame] | 141 | /* reader lock assumption: only main thread will call pool_get */ |
| 142 | clib_rwlock_reader_lock (&tm->half_open_rwlock); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 143 | pool_get (tm->half_open_ctx_pool, ctx); |
Florin Coras | eb97e5f | 2018-10-15 21:35:42 -0700 | [diff] [blame] | 144 | ctx_index = ctx - tm->half_open_ctx_pool; |
Ping Yu | e6446a3 | 2018-08-28 18:56:27 -0400 | [diff] [blame] | 145 | clib_rwlock_reader_unlock (&tm->half_open_rwlock); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 146 | } |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 147 | clib_memset (ctx, 0, sizeof (*ctx)); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 148 | return ctx_index; |
| 149 | } |
| 150 | |
| 151 | void |
| 152 | tls_ctx_half_open_free (u32 ho_index) |
| 153 | { |
| 154 | tls_main_t *tm = &tls_main; |
| 155 | clib_rwlock_writer_lock (&tm->half_open_rwlock); |
| 156 | pool_put_index (tls_main.half_open_ctx_pool, ho_index); |
| 157 | clib_rwlock_writer_unlock (&tm->half_open_rwlock); |
| 158 | } |
| 159 | |
| 160 | tls_ctx_t * |
| 161 | tls_ctx_half_open_get (u32 ctx_index) |
| 162 | { |
| 163 | tls_main_t *tm = &tls_main; |
| 164 | clib_rwlock_reader_lock (&tm->half_open_rwlock); |
| 165 | return pool_elt_at_index (tm->half_open_ctx_pool, ctx_index); |
| 166 | } |
| 167 | |
| 168 | void |
| 169 | tls_ctx_half_open_reader_unlock () |
| 170 | { |
| 171 | clib_rwlock_reader_unlock (&tls_main.half_open_rwlock); |
| 172 | } |
| 173 | |
| 174 | u32 |
| 175 | tls_ctx_half_open_index (tls_ctx_t * ctx) |
| 176 | { |
| 177 | return (ctx - tls_main.half_open_ctx_pool); |
| 178 | } |
| 179 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 180 | void |
| 181 | tls_notify_app_enqueue (tls_ctx_t * ctx, stream_session_t * app_session) |
| 182 | { |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 183 | app_worker_t *app; |
| 184 | app = app_worker_get_if_valid (app_session->app_wrk_index); |
Florin Coras | 5090c57 | 2018-03-18 08:22:17 -0700 | [diff] [blame] | 185 | if (PREDICT_TRUE (app != 0)) |
| 186 | tls_add_app_q_evt (app, app_session); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 187 | } |
| 188 | |
| 189 | int |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 190 | tls_notify_app_accept (tls_ctx_t * ctx) |
| 191 | { |
| 192 | stream_session_t *app_listener, *app_session; |
| 193 | segment_manager_t *sm; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 194 | app_worker_t *app_wrk; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 195 | application_t *app; |
| 196 | tls_ctx_t *lctx; |
| 197 | int rv; |
| 198 | |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 199 | app_wrk = app_worker_get_if_valid (ctx->parent_app_index); |
| 200 | if (!app_wrk) |
| 201 | { |
| 202 | tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ()); |
| 203 | return -1; |
| 204 | } |
| 205 | |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 206 | app = application_get (app_wrk->app_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 207 | lctx = tls_listener_ctx_get (ctx->listener_ctx_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 208 | |
| 209 | app_session = session_alloc (vlib_get_thread_index ()); |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 210 | app_session->app_wrk_index = ctx->parent_app_index; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 211 | app_session->connection_index = ctx->tls_ctx_handle; |
Ping Yu | a0c29a9 | 2018-08-16 19:11:05 -0400 | [diff] [blame] | 212 | |
| 213 | app_listener = listen_session_get_from_handle (lctx->app_session_handle); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 214 | app_session->session_type = app_listener->session_type; |
| 215 | app_session->listener_index = app_listener->session_index; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 216 | sm = app_worker_get_listen_segment_manager (app_wrk, app_listener); |
Florin Coras | ab2f6db | 2018-08-31 14:31:41 -0700 | [diff] [blame] | 217 | app_session->t_app_index = tls_main.app_index; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 218 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 219 | if ((rv = session_alloc_fifos (sm, app_session))) |
| 220 | { |
| 221 | TLS_DBG (1, "failed to allocate fifos"); |
| 222 | return rv; |
| 223 | } |
| 224 | ctx->c_s_index = app_session->session_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 225 | ctx->app_session_handle = session_handle (app_session); |
Florin Coras | b5e94e3 | 2018-09-14 14:46:39 -0700 | [diff] [blame] | 226 | session_lookup_add_connection (&ctx->connection, |
| 227 | session_handle (app_session)); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 228 | return app->cb_fns.session_accept_callback (app_session); |
| 229 | } |
| 230 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 231 | int |
Florin Coras | 8f89dd0 | 2018-03-05 16:53:07 -0800 | [diff] [blame] | 232 | tls_notify_app_connected (tls_ctx_t * ctx, u8 is_failed) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 233 | { |
| 234 | int (*cb_fn) (u32, u32, stream_session_t *, u8); |
| 235 | stream_session_t *app_session; |
| 236 | segment_manager_t *sm; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 237 | app_worker_t *app_wrk; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 238 | application_t *app; |
| 239 | |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 240 | app_wrk = app_worker_get_if_valid (ctx->parent_app_index); |
| 241 | if (!app_wrk) |
| 242 | { |
Florin Coras | c01d578 | 2018-10-17 14:53:11 -0700 | [diff] [blame] | 243 | tls_disconnect_transport (ctx); |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 244 | return -1; |
| 245 | } |
| 246 | |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 247 | app = application_get (app_wrk->app_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 248 | cb_fn = app->cb_fns.session_connected_callback; |
| 249 | |
Florin Coras | 8f89dd0 | 2018-03-05 16:53:07 -0800 | [diff] [blame] | 250 | if (is_failed) |
| 251 | goto failed; |
| 252 | |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 253 | sm = app_worker_get_connect_segment_manager (app_wrk); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 254 | app_session = session_alloc (vlib_get_thread_index ()); |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 255 | app_session->app_wrk_index = ctx->parent_app_index; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 256 | app_session->connection_index = ctx->tls_ctx_handle; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 257 | app_session->session_type = |
| 258 | session_type_from_proto_and_ip (TRANSPORT_PROTO_TLS, ctx->tcp_is_ip4); |
Florin Coras | ab2f6db | 2018-08-31 14:31:41 -0700 | [diff] [blame] | 259 | app_session->t_app_index = tls_main.app_index; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 260 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 261 | if (session_alloc_fifos (sm, app_session)) |
| 262 | goto failed; |
| 263 | |
| 264 | ctx->app_session_handle = session_handle (app_session); |
| 265 | ctx->c_s_index = app_session->session_index; |
Florin Coras | c01d578 | 2018-10-17 14:53:11 -0700 | [diff] [blame] | 266 | app_session->session_state = SESSION_STATE_CONNECTING; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 267 | if (cb_fn (ctx->parent_app_index, ctx->parent_app_api_context, |
| 268 | app_session, 0 /* not failed */ )) |
| 269 | { |
| 270 | TLS_DBG (1, "failed to notify app"); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 271 | tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ()); |
Florin Coras | eb97e5f | 2018-10-15 21:35:42 -0700 | [diff] [blame] | 272 | return -1; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 273 | } |
| 274 | |
Florin Coras | c01d578 | 2018-10-17 14:53:11 -0700 | [diff] [blame] | 275 | app_session->session_state = SESSION_STATE_READY; |
Florin Coras | b5e94e3 | 2018-09-14 14:46:39 -0700 | [diff] [blame] | 276 | session_lookup_add_connection (&ctx->connection, |
| 277 | session_handle (app_session)); |
| 278 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 279 | return 0; |
| 280 | |
| 281 | failed: |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 282 | tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ()); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 283 | return cb_fn (ctx->parent_app_index, ctx->parent_app_api_context, 0, |
| 284 | 1 /* failed */ ); |
| 285 | } |
| 286 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 287 | static inline void |
| 288 | tls_ctx_parse_handle (u32 ctx_handle, u32 * ctx_index, u32 * engine_type) |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 289 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 290 | *ctx_index = ctx_handle & TLS_IDX_MASK; |
| 291 | *engine_type = ctx_handle >> TLS_ENGINE_TYPE_SHIFT; |
| 292 | } |
| 293 | |
| 294 | static inline tls_engine_type_t |
| 295 | tls_get_engine_type (tls_engine_type_t preferred) |
| 296 | { |
| 297 | if (!tls_vfts[preferred].ctx_alloc) |
| 298 | return tls_get_available_engine (); |
| 299 | return preferred; |
| 300 | } |
| 301 | |
| 302 | static inline u32 |
| 303 | tls_ctx_alloc (tls_engine_type_t engine_type) |
| 304 | { |
| 305 | u32 ctx_index; |
| 306 | ctx_index = tls_vfts[engine_type].ctx_alloc (); |
| 307 | return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 308 | } |
| 309 | |
| 310 | static inline void |
| 311 | tls_ctx_free (tls_ctx_t * ctx) |
| 312 | { |
| 313 | vec_free (ctx->srv_hostname); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 314 | tls_vfts[ctx->tls_ctx_engine].ctx_free (ctx); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 315 | } |
| 316 | |
| 317 | static inline tls_ctx_t * |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 318 | tls_ctx_get (u32 ctx_handle) |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 319 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 320 | u32 ctx_index, engine_type; |
| 321 | tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type); |
| 322 | return tls_vfts[engine_type].ctx_get (ctx_index); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 323 | } |
| 324 | |
| 325 | static inline tls_ctx_t * |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 326 | tls_ctx_get_w_thread (u32 ctx_handle, u8 thread_index) |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 327 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 328 | u32 ctx_index, engine_type; |
| 329 | tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type); |
| 330 | return tls_vfts[engine_type].ctx_get_w_thread (ctx_index, thread_index); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 331 | } |
| 332 | |
| 333 | static inline int |
| 334 | tls_ctx_init_server (tls_ctx_t * ctx) |
| 335 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 336 | return tls_vfts[ctx->tls_ctx_engine].ctx_init_server (ctx); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 337 | } |
| 338 | |
| 339 | static inline int |
| 340 | tls_ctx_init_client (tls_ctx_t * ctx) |
| 341 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 342 | return tls_vfts[ctx->tls_ctx_engine].ctx_init_client (ctx); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 343 | } |
| 344 | |
| 345 | static inline int |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 346 | tls_ctx_write (tls_ctx_t * ctx, stream_session_t * app_session) |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 347 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 348 | return tls_vfts[ctx->tls_ctx_engine].ctx_write (ctx, app_session); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 349 | } |
| 350 | |
| 351 | static inline int |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 352 | tls_ctx_read (tls_ctx_t * ctx, stream_session_t * tls_session) |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 353 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 354 | return tls_vfts[ctx->tls_ctx_engine].ctx_read (ctx, tls_session); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 355 | } |
| 356 | |
| 357 | static inline u8 |
| 358 | tls_ctx_handshake_is_over (tls_ctx_t * ctx) |
| 359 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 360 | return tls_vfts[ctx->tls_ctx_engine].ctx_handshake_is_over (ctx); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 361 | } |
| 362 | |
| 363 | void |
| 364 | tls_session_reset_callback (stream_session_t * s) |
| 365 | { |
| 366 | clib_warning ("called..."); |
| 367 | } |
| 368 | |
| 369 | int |
Florin Coras | fa76a76 | 2018-11-29 12:40:10 -0800 | [diff] [blame] | 370 | tls_add_segment_callback (u32 client_index, u64 segment_handle) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 371 | { |
| 372 | /* No-op for builtin */ |
| 373 | return 0; |
| 374 | } |
| 375 | |
| 376 | int |
Florin Coras | fa76a76 | 2018-11-29 12:40:10 -0800 | [diff] [blame] | 377 | tls_del_segment_callback (u32 client_index, u64 segment_handle) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 378 | { |
| 379 | return 0; |
| 380 | } |
| 381 | |
| 382 | void |
| 383 | tls_session_disconnect_callback (stream_session_t * tls_session) |
| 384 | { |
| 385 | stream_session_t *app_session; |
| 386 | tls_ctx_t *ctx; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 387 | app_worker_t *app_wrk; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 388 | application_t *app; |
| 389 | |
| 390 | ctx = tls_ctx_get (tls_session->opaque); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 391 | if (!tls_ctx_handshake_is_over (ctx)) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 392 | { |
Florin Coras | 5a2ec8f | 2018-12-27 11:53:11 -0800 | [diff] [blame^] | 393 | session_close (tls_session); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 394 | return; |
| 395 | } |
| 396 | ctx->is_passive_close = 1; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 397 | app_wrk = app_worker_get (ctx->parent_app_index); |
| 398 | app = application_get (app_wrk->app_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 399 | app_session = session_get_from_handle (ctx->app_session_handle); |
| 400 | app->cb_fns.session_disconnect_callback (app_session); |
| 401 | } |
| 402 | |
| 403 | int |
| 404 | tls_session_accept_callback (stream_session_t * tls_session) |
| 405 | { |
| 406 | stream_session_t *tls_listener; |
| 407 | tls_ctx_t *lctx, *ctx; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 408 | u32 ctx_handle; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 409 | |
Florin Coras | 5c9083d | 2018-04-13 06:39:07 -0700 | [diff] [blame] | 410 | tls_listener = listen_session_get (tls_session->listener_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 411 | lctx = tls_listener_ctx_get (tls_listener->opaque); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 412 | |
| 413 | ctx_handle = tls_ctx_alloc (lctx->tls_ctx_engine); |
| 414 | ctx = tls_ctx_get (ctx_handle); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 415 | memcpy (ctx, lctx, sizeof (*lctx)); |
| 416 | ctx->c_thread_index = vlib_get_thread_index (); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 417 | ctx->tls_ctx_handle = ctx_handle; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 418 | tls_session->session_state = SESSION_STATE_READY; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 419 | tls_session->opaque = ctx_handle; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 420 | ctx->tls_session_handle = session_handle (tls_session); |
| 421 | ctx->listener_ctx_index = tls_listener->opaque; |
| 422 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 423 | TLS_DBG (1, "Accept on listener %u new connection [%u]%x", |
| 424 | tls_listener->opaque, vlib_get_thread_index (), ctx_handle); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 425 | |
| 426 | return tls_ctx_init_server (ctx); |
| 427 | } |
| 428 | |
| 429 | int |
| 430 | tls_app_tx_callback (stream_session_t * app_session) |
| 431 | { |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 432 | tls_ctx_t *ctx; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 433 | if (PREDICT_FALSE (app_session->session_state == SESSION_STATE_CLOSED)) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 434 | return 0; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 435 | ctx = tls_ctx_get (app_session->connection_index); |
| 436 | tls_ctx_write (ctx, app_session); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 437 | return 0; |
| 438 | } |
| 439 | |
| 440 | int |
| 441 | tls_app_rx_callback (stream_session_t * tls_session) |
| 442 | { |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 443 | tls_ctx_t *ctx; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 444 | |
| 445 | ctx = tls_ctx_get (tls_session->opaque); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 446 | tls_ctx_read (ctx, tls_session); |
| 447 | return 0; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 448 | } |
| 449 | |
| 450 | int |
| 451 | tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index, |
| 452 | stream_session_t * tls_session, u8 is_fail) |
| 453 | { |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 454 | tls_ctx_t *ho_ctx, *ctx; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 455 | u32 ctx_handle; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 456 | |
| 457 | ho_ctx = tls_ctx_half_open_get (ho_ctx_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 458 | |
| 459 | if (is_fail) |
Florin Coras | dcde927 | 2018-03-02 09:23:42 -0800 | [diff] [blame] | 460 | { |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 461 | int (*cb_fn) (u32, u32, stream_session_t *, u8), rv = 0; |
Florin Coras | 57791ad | 2018-08-27 10:07:40 -0700 | [diff] [blame] | 462 | u32 wrk_index, api_context; |
| 463 | app_worker_t *app_wrk; |
| 464 | application_t *app; |
| 465 | |
| 466 | wrk_index = ho_ctx->parent_app_index; |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 467 | app_wrk = app_worker_get_if_valid (ho_ctx->parent_app_index); |
| 468 | if (app_wrk) |
| 469 | { |
| 470 | api_context = ho_ctx->c_s_index; |
| 471 | app = application_get (app_wrk->app_index); |
| 472 | cb_fn = app->cb_fns.session_connected_callback; |
| 473 | rv = cb_fn (wrk_index, api_context, 0, 1 /* failed */ ); |
| 474 | } |
Florin Coras | dcde927 | 2018-03-02 09:23:42 -0800 | [diff] [blame] | 475 | tls_ctx_half_open_reader_unlock (); |
| 476 | tls_ctx_half_open_free (ho_ctx_index); |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 477 | return rv; |
Florin Coras | dcde927 | 2018-03-02 09:23:42 -0800 | [diff] [blame] | 478 | } |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 479 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 480 | ctx_handle = tls_ctx_alloc (ho_ctx->tls_ctx_engine); |
| 481 | ctx = tls_ctx_get (ctx_handle); |
Dave Barach | 178cf49 | 2018-11-13 16:34:13 -0500 | [diff] [blame] | 482 | clib_memcpy_fast (ctx, ho_ctx, sizeof (*ctx)); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 483 | tls_ctx_half_open_reader_unlock (); |
| 484 | tls_ctx_half_open_free (ho_ctx_index); |
| 485 | |
Florin Coras | dcde927 | 2018-03-02 09:23:42 -0800 | [diff] [blame] | 486 | ctx->c_thread_index = vlib_get_thread_index (); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 487 | ctx->tls_ctx_handle = ctx_handle; |
Florin Coras | dcde927 | 2018-03-02 09:23:42 -0800 | [diff] [blame] | 488 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 489 | TLS_DBG (1, "TCP connect for %u returned %u. New connection [%u]%x", |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 490 | ho_ctx_index, is_fail, vlib_get_thread_index (), |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 491 | (ctx) ? ctx_handle : ~0); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 492 | |
| 493 | ctx->tls_session_handle = session_handle (tls_session); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 494 | tls_session->opaque = ctx_handle; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 495 | tls_session->session_state = SESSION_STATE_READY; |
| 496 | |
| 497 | return tls_ctx_init_client (ctx); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 498 | } |
| 499 | |
| 500 | /* *INDENT-OFF* */ |
| 501 | static session_cb_vft_t tls_app_cb_vft = { |
| 502 | .session_accept_callback = tls_session_accept_callback, |
| 503 | .session_disconnect_callback = tls_session_disconnect_callback, |
| 504 | .session_connected_callback = tls_session_connected_callback, |
| 505 | .session_reset_callback = tls_session_reset_callback, |
| 506 | .add_segment_callback = tls_add_segment_callback, |
| 507 | .del_segment_callback = tls_del_segment_callback, |
| 508 | .builtin_app_rx_callback = tls_app_rx_callback, |
| 509 | .builtin_app_tx_callback = tls_app_tx_callback, |
| 510 | }; |
| 511 | /* *INDENT-ON* */ |
| 512 | |
| 513 | int |
Florin Coras | 5665ced | 2018-10-25 18:03:45 -0700 | [diff] [blame] | 514 | tls_connect (transport_endpoint_cfg_t * tep) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 515 | { |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 516 | vnet_connect_args_t _cargs = { {}, }, *cargs = &_cargs; |
Florin Coras | 5665ced | 2018-10-25 18:03:45 -0700 | [diff] [blame] | 517 | session_endpoint_cfg_t *sep; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 518 | tls_engine_type_t engine_type; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 519 | tls_main_t *tm = &tls_main; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 520 | app_worker_t *app_wrk; |
| 521 | clib_error_t *error; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 522 | application_t *app; |
| 523 | tls_ctx_t *ctx; |
| 524 | u32 ctx_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 525 | |
Florin Coras | 5665ced | 2018-10-25 18:03:45 -0700 | [diff] [blame] | 526 | sep = (session_endpoint_cfg_t *) tep; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 527 | app_wrk = app_worker_get (sep->app_wrk_index); |
| 528 | app = application_get (app_wrk->app_index); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 529 | engine_type = tls_get_engine_type (app->tls_engine); |
| 530 | if (engine_type == TLS_ENGINE_NONE) |
| 531 | { |
| 532 | clib_warning ("No tls engine_type available"); |
| 533 | return -1; |
| 534 | } |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 535 | |
| 536 | ctx_index = tls_ctx_half_open_alloc (); |
| 537 | ctx = tls_ctx_half_open_get (ctx_index); |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 538 | ctx->parent_app_index = sep->app_wrk_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 539 | ctx->parent_app_api_context = sep->opaque; |
| 540 | ctx->tcp_is_ip4 = sep->is_ip4; |
Florin Coras | 8f89dd0 | 2018-03-05 16:53:07 -0800 | [diff] [blame] | 541 | if (sep->hostname) |
| 542 | { |
| 543 | ctx->srv_hostname = format (0, "%v", sep->hostname); |
| 544 | vec_terminate_c_string (ctx->srv_hostname); |
| 545 | } |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 546 | tls_ctx_half_open_reader_unlock (); |
| 547 | |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 548 | app_worker_alloc_connects_segment_manager (app_wrk); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 549 | ctx->tls_ctx_engine = engine_type; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 550 | |
Dave Barach | 178cf49 | 2018-11-13 16:34:13 -0500 | [diff] [blame] | 551 | clib_memcpy_fast (&cargs->sep, sep, sizeof (session_endpoint_t)); |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 552 | cargs->sep.transport_proto = TRANSPORT_PROTO_TCP; |
| 553 | cargs->app_index = tm->app_index; |
| 554 | cargs->api_context = ctx_index; |
| 555 | if ((error = vnet_connect (cargs))) |
| 556 | return clib_error_get_code (error); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 557 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 558 | TLS_DBG (1, "New connect request %u engine %d", ctx_index, engine_type); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 559 | return 0; |
| 560 | } |
| 561 | |
| 562 | void |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 563 | tls_disconnect (u32 ctx_handle, u32 thread_index) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 564 | { |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 565 | tls_ctx_t *ctx; |
| 566 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 567 | TLS_DBG (1, "Disconnecting %x", ctx_handle); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 568 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 569 | ctx = tls_ctx_get (ctx_handle); |
Florin Coras | c01d578 | 2018-10-17 14:53:11 -0700 | [diff] [blame] | 570 | tls_disconnect_transport (ctx); |
Florin Coras | 5a2ec8f | 2018-12-27 11:53:11 -0800 | [diff] [blame^] | 571 | session_transport_delete_notify (&ctx->connection); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 572 | tls_ctx_free (ctx); |
| 573 | } |
| 574 | |
| 575 | u32 |
| 576 | tls_start_listen (u32 app_listener_index, transport_endpoint_t * tep) |
| 577 | { |
Florin Coras | 74cac88 | 2018-09-07 09:13:15 -0700 | [diff] [blame] | 578 | vnet_bind_args_t _bargs, *args = &_bargs; |
Florin Coras | ab2f6db | 2018-08-31 14:31:41 -0700 | [diff] [blame] | 579 | app_worker_t *app_wrk; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 580 | tls_main_t *tm = &tls_main; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 581 | session_handle_t tls_handle; |
Florin Coras | 5665ced | 2018-10-25 18:03:45 -0700 | [diff] [blame] | 582 | session_endpoint_cfg_t *sep; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 583 | stream_session_t *tls_listener; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 584 | stream_session_t *app_listener; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 585 | tls_engine_type_t engine_type; |
Florin Coras | 74cac88 | 2018-09-07 09:13:15 -0700 | [diff] [blame] | 586 | application_t *app; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 587 | tls_ctx_t *lctx; |
| 588 | u32 lctx_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 589 | |
Florin Coras | 5665ced | 2018-10-25 18:03:45 -0700 | [diff] [blame] | 590 | sep = (session_endpoint_cfg_t *) tep; |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 591 | app_wrk = app_worker_get (sep->app_wrk_index); |
| 592 | app = application_get (app_wrk->app_index); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 593 | engine_type = tls_get_engine_type (app->tls_engine); |
| 594 | if (engine_type == TLS_ENGINE_NONE) |
| 595 | { |
| 596 | clib_warning ("No tls engine_type available"); |
| 597 | return -1; |
| 598 | } |
| 599 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 600 | sep->transport_proto = TRANSPORT_PROTO_TCP; |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 601 | clib_memset (args, 0, sizeof (*args)); |
Florin Coras | 74cac88 | 2018-09-07 09:13:15 -0700 | [diff] [blame] | 602 | args->app_index = tm->app_index; |
| 603 | args->sep_ext = *sep; |
| 604 | if (vnet_bind (args)) |
| 605 | return -1; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 606 | |
Florin Coras | 74cac88 | 2018-09-07 09:13:15 -0700 | [diff] [blame] | 607 | tls_handle = args->handle; |
| 608 | lctx_index = tls_listener_ctx_alloc (); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 609 | tls_listener = listen_session_get_from_handle (tls_handle); |
| 610 | tls_listener->opaque = lctx_index; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 611 | |
Florin Coras | 5c9083d | 2018-04-13 06:39:07 -0700 | [diff] [blame] | 612 | app_listener = listen_session_get (app_listener_index); |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 613 | |
| 614 | lctx = tls_listener_ctx_get (lctx_index); |
Florin Coras | 1553197 | 2018-08-12 23:50:53 -0700 | [diff] [blame] | 615 | lctx->parent_app_index = sep->app_wrk_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 616 | lctx->tls_session_handle = tls_handle; |
| 617 | lctx->app_session_handle = listen_session_get_handle (app_listener); |
| 618 | lctx->tcp_is_ip4 = sep->is_ip4; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 619 | lctx->tls_ctx_engine = engine_type; |
| 620 | |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 621 | tls_vfts[engine_type].ctx_start_listen (lctx); |
| 622 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 623 | TLS_DBG (1, "Started listening %d, engine type %d", lctx_index, |
| 624 | engine_type); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 625 | return lctx_index; |
| 626 | } |
| 627 | |
| 628 | u32 |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 629 | tls_stop_listen (u32 lctx_index) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 630 | { |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 631 | tls_engine_type_t engine_type; |
Florin Coras | b5e94e3 | 2018-09-14 14:46:39 -0700 | [diff] [blame] | 632 | tls_ctx_t *lctx; |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 633 | |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 634 | lctx = tls_listener_ctx_get (lctx_index); |
Florin Coras | b5e94e3 | 2018-09-14 14:46:39 -0700 | [diff] [blame] | 635 | vnet_unbind_args_t a = { |
| 636 | .handle = lctx->tls_session_handle, |
| 637 | .app_index = tls_main.app_index, |
| 638 | .wrk_map_index = 0 /* default wrk */ |
| 639 | }; |
| 640 | if (vnet_unbind (&a)) |
| 641 | clib_warning ("unbind returned"); |
| 642 | |
Ping Yu | decda5b | 2018-08-13 06:20:00 -0400 | [diff] [blame] | 643 | engine_type = lctx->tls_ctx_engine; |
| 644 | tls_vfts[engine_type].ctx_stop_listen (lctx); |
| 645 | |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 646 | tls_listener_ctx_free (lctx); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 647 | return 0; |
| 648 | } |
| 649 | |
| 650 | transport_connection_t * |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 651 | tls_connection_get (u32 ctx_index, u32 thread_index) |
| 652 | { |
| 653 | tls_ctx_t *ctx; |
| 654 | ctx = tls_ctx_get_w_thread (ctx_index, thread_index); |
| 655 | return &ctx->connection; |
| 656 | } |
| 657 | |
| 658 | transport_connection_t * |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 659 | tls_listener_get (u32 listener_index) |
| 660 | { |
| 661 | tls_ctx_t *ctx; |
| 662 | ctx = tls_listener_ctx_get (listener_index); |
| 663 | return &ctx->connection; |
| 664 | } |
| 665 | |
| 666 | u8 * |
| 667 | format_tls_ctx (u8 * s, va_list * args) |
| 668 | { |
| 669 | tls_ctx_t *ctx = va_arg (*args, tls_ctx_t *); |
| 670 | u32 thread_index = va_arg (*args, u32); |
| 671 | u32 child_si, child_ti; |
| 672 | |
| 673 | session_parse_handle (ctx->tls_session_handle, &child_si, &child_ti); |
| 674 | if (thread_index != child_ti) |
| 675 | clib_warning ("app and tls sessions are on different threads!"); |
| 676 | |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 677 | s = format (s, "[#%d][TLS] app %u child %u", child_ti, |
| 678 | ctx->parent_app_index, child_si); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 679 | return s; |
| 680 | } |
| 681 | |
| 682 | u8 * |
| 683 | format_tls_connection (u8 * s, va_list * args) |
| 684 | { |
| 685 | u32 ctx_index = va_arg (*args, u32); |
| 686 | u32 thread_index = va_arg (*args, u32); |
| 687 | u32 verbose = va_arg (*args, u32); |
| 688 | tls_ctx_t *ctx; |
| 689 | |
| 690 | ctx = tls_ctx_get_w_thread (ctx_index, thread_index); |
| 691 | if (!ctx) |
| 692 | return s; |
| 693 | |
| 694 | s = format (s, "%-50U", format_tls_ctx, ctx, thread_index); |
| 695 | if (verbose) |
| 696 | { |
Florin Coras | ef91534 | 2018-09-29 10:23:06 -0700 | [diff] [blame] | 697 | stream_session_t *ts; |
| 698 | ts = session_get_from_handle (ctx->app_session_handle); |
| 699 | s = format (s, "state: %-7u", ts->session_state); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 700 | if (verbose > 1) |
| 701 | s = format (s, "\n"); |
| 702 | } |
| 703 | return s; |
| 704 | } |
| 705 | |
| 706 | u8 * |
| 707 | format_tls_listener (u8 * s, va_list * args) |
| 708 | { |
| 709 | u32 tc_index = va_arg (*args, u32); |
| 710 | tls_ctx_t *ctx = tls_listener_ctx_get (tc_index); |
Florin Coras | 5c9083d | 2018-04-13 06:39:07 -0700 | [diff] [blame] | 711 | u32 listener_index, thread_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 712 | |
Florin Coras | 5c9083d | 2018-04-13 06:39:07 -0700 | [diff] [blame] | 713 | listen_session_parse_handle (ctx->tls_session_handle, &listener_index, |
| 714 | &thread_index); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 715 | return format (s, "[TLS] listener app %u child %u", ctx->parent_app_index, |
| 716 | listener_index); |
| 717 | } |
| 718 | |
| 719 | u8 * |
| 720 | format_tls_half_open (u8 * s, va_list * args) |
| 721 | { |
| 722 | u32 tc_index = va_arg (*args, u32); |
| 723 | tls_ctx_t *ctx = tls_ctx_half_open_get (tc_index); |
| 724 | s = format (s, "[TLS] half-open app %u", ctx->parent_app_index); |
| 725 | tls_ctx_half_open_reader_unlock (); |
| 726 | return s; |
| 727 | } |
| 728 | |
| 729 | /* *INDENT-OFF* */ |
| 730 | const static transport_proto_vft_t tls_proto = { |
| 731 | .open = tls_connect, |
| 732 | .close = tls_disconnect, |
| 733 | .bind = tls_start_listen, |
Florin Coras | e3e2f07 | 2018-03-04 07:24:30 -0800 | [diff] [blame] | 734 | .get_connection = tls_connection_get, |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 735 | .get_listener = tls_listener_get, |
| 736 | .unbind = tls_stop_listen, |
| 737 | .tx_type = TRANSPORT_TX_INTERNAL, |
| 738 | .service_type = TRANSPORT_SERVICE_APP, |
| 739 | .format_connection = format_tls_connection, |
| 740 | .format_half_open = format_tls_half_open, |
| 741 | .format_listener = format_tls_listener, |
| 742 | }; |
| 743 | /* *INDENT-ON* */ |
| 744 | |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 745 | void |
| 746 | tls_register_engine (const tls_engine_vft_t * vft, tls_engine_type_t type) |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 747 | { |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 748 | vec_validate (tls_vfts, type); |
| 749 | tls_vfts[type] = *vft; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 750 | } |
| 751 | |
Dave Barach | cc5677b | 2018-03-28 19:08:45 -0400 | [diff] [blame] | 752 | static clib_error_t * |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 753 | tls_init (vlib_main_t * vm) |
| 754 | { |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 755 | vlib_thread_main_t *vtm = vlib_get_thread_main (); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 756 | vnet_app_attach_args_t _a, *a = &_a; |
| 757 | u64 options[APP_OPTIONS_N_OPTIONS]; |
| 758 | u32 segment_size = 512 << 20; |
| 759 | tls_main_t *tm = &tls_main; |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 760 | u32 fifo_size = 64 << 10; |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 761 | u32 num_threads; |
| 762 | |
| 763 | num_threads = 1 /* main thread */ + vtm->n_threads; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 764 | |
Dave Barach | b7b9299 | 2018-10-17 10:38:51 -0400 | [diff] [blame] | 765 | clib_memset (a, 0, sizeof (*a)); |
| 766 | clib_memset (options, 0, sizeof (options)); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 767 | |
| 768 | a->session_cb_vft = &tls_app_cb_vft; |
Florin Coras | 0bee9ce | 2018-03-22 21:24:31 -0700 | [diff] [blame] | 769 | a->api_client_index = APP_INVALID_INDEX; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 770 | a->options = options; |
Florin Coras | 0bee9ce | 2018-03-22 21:24:31 -0700 | [diff] [blame] | 771 | a->name = format (0, "tls"); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 772 | a->options[APP_OPTIONS_SEGMENT_SIZE] = segment_size; |
| 773 | a->options[APP_OPTIONS_RX_FIFO_SIZE] = fifo_size; |
| 774 | a->options[APP_OPTIONS_TX_FIFO_SIZE] = fifo_size; |
| 775 | a->options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN; |
| 776 | a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE; |
Florin Coras | da3eec1 | 2018-09-07 13:29:17 -0700 | [diff] [blame] | 777 | a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_TRANSPORT_APP; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 778 | |
| 779 | if (vnet_application_attach (a)) |
| 780 | { |
| 781 | clib_warning ("failed to attach tls app"); |
| 782 | return clib_error_return (0, "failed to attach tls app"); |
| 783 | } |
| 784 | |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 785 | if (!tm->ca_cert_path) |
| 786 | tm->ca_cert_path = TLS_CA_CERT_PATH; |
| 787 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 788 | tm->app_index = a->app_index; |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 789 | clib_rwlock_init (&tm->half_open_rwlock); |
| 790 | |
Florin Coras | 58d36f0 | 2018-03-09 13:05:53 -0800 | [diff] [blame] | 791 | vec_validate (tm->rx_bufs, num_threads - 1); |
| 792 | vec_validate (tm->tx_bufs, num_threads - 1); |
| 793 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 794 | transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto, |
| 795 | FIB_PROTOCOL_IP4, ~0); |
| 796 | transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto, |
| 797 | FIB_PROTOCOL_IP6, ~0); |
Florin Coras | 0bee9ce | 2018-03-22 21:24:31 -0700 | [diff] [blame] | 798 | vec_free (a->name); |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 799 | return 0; |
| 800 | } |
| 801 | |
| 802 | VLIB_INIT_FUNCTION (tls_init); |
| 803 | |
Florin Coras | 8f89dd0 | 2018-03-05 16:53:07 -0800 | [diff] [blame] | 804 | static clib_error_t * |
| 805 | tls_config_fn (vlib_main_t * vm, unformat_input_t * input) |
| 806 | { |
| 807 | tls_main_t *tm = &tls_main; |
| 808 | while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT) |
| 809 | { |
| 810 | if (unformat (input, "use-test-cert-in-ca")) |
| 811 | tm->use_test_cert_in_ca = 1; |
| 812 | else if (unformat (input, "ca-cert-path %s", &tm->ca_cert_path)) |
| 813 | ; |
| 814 | else |
| 815 | return clib_error_return (0, "unknown input `%U'", |
| 816 | format_unformat_error, input); |
| 817 | } |
| 818 | return 0; |
| 819 | } |
| 820 | |
| 821 | VLIB_EARLY_CONFIG_FUNCTION (tls_config_fn, "tls"); |
Florin Coras | d77eee6 | 2018-03-07 08:49:27 -0800 | [diff] [blame] | 822 | |
| 823 | tls_main_t * |
| 824 | vnet_tls_get_main (void) |
| 825 | { |
| 826 | return &tls_main; |
| 827 | } |
| 828 | |
Florin Coras | 371ca50 | 2018-02-21 12:07:41 -0800 | [diff] [blame] | 829 | /* |
| 830 | * fd.io coding-style-patch-verification: ON |
| 831 | * |
| 832 | * Local Variables: |
| 833 | * eval: (c-set-style "gnu") |
| 834 | * End: |
| 835 | */ |