blob: fdba08c59154fb7b2dd134e27dff9e7d45da20b4 [file] [log] [blame]
Florin Coras371ca502018-02-21 12:07:41 -08001/*
2 * Copyright (c) 2018 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16#include <vnet/session/application_interface.h>
17#include <vppinfra/lock.h>
Florin Corasd77eee62018-03-07 08:49:27 -080018#include <vnet/tls/tls.h>
Florin Coras371ca502018-02-21 12:07:41 -080019
20static tls_main_t tls_main;
Florin Corasd77eee62018-03-07 08:49:27 -080021static tls_engine_vft_t *tls_vfts;
Florin Coras371ca502018-02-21 12:07:41 -080022
Florin Coras58d36f02018-03-09 13:05:53 -080023#define TLS_INVALID_HANDLE ~0
24#define TLS_IDX_MASK 0x00FFFFFF
25#define TLS_ENGINE_TYPE_SHIFT 29
26
27void tls_disconnect (u32 ctx_handle, u32 thread_index);
28
Florin Corasc01d5782018-10-17 14:53:11 -070029static void
30tls_disconnect_transport (tls_ctx_t * ctx)
31{
32 vnet_disconnect_args_t a = {
33 .handle = ctx->tls_session_handle,
34 .app_index = tls_main.app_index,
35 };
36
37 if (vnet_disconnect_session (&a))
38 clib_warning ("disconnect returned");
39}
40
Florin Coras58d36f02018-03-09 13:05:53 -080041tls_engine_type_t
42tls_get_available_engine (void)
43{
44 int i;
45 for (i = 0; i < vec_len (tls_vfts); i++)
46 {
47 if (tls_vfts[i].ctx_alloc)
48 return i;
49 }
50 return TLS_ENGINE_NONE;
51}
Florin Coras371ca502018-02-21 12:07:41 -080052
Florin Corasd77eee62018-03-07 08:49:27 -080053int
Florin Corasef915342018-09-29 10:23:06 -070054tls_add_vpp_q_rx_evt (stream_session_t * s)
Florin Coras371ca502018-02-21 12:07:41 -080055{
Florin Corasef915342018-09-29 10:23:06 -070056 if (svm_fifo_set_event (s->server_rx_fifo))
57 session_send_io_evt_to_thread (s->server_rx_fifo, FIFO_EVENT_APP_RX);
58 return 0;
59}
60
61int
62tls_add_vpp_q_builtin_rx_evt (stream_session_t * s)
63{
64 if (svm_fifo_set_event (s->server_rx_fifo))
65 session_send_io_evt_to_thread (s->server_rx_fifo, FIFO_EVENT_BUILTIN_RX);
66 return 0;
67}
68
69int
70tls_add_vpp_q_tx_evt (stream_session_t * s)
71{
72 if (svm_fifo_set_event (s->server_tx_fifo))
73 session_send_io_evt_to_thread (s->server_tx_fifo, FIFO_EVENT_APP_TX);
74 return 0;
75}
76
77int
78tls_add_vpp_q_builtin_tx_evt (stream_session_t * s)
79{
80 if (svm_fifo_set_event (s->server_tx_fifo))
81 session_send_io_evt_to_thread_custom (s, s->thread_index,
82 FIFO_EVENT_BUILTIN_TX);
Florin Coras371ca502018-02-21 12:07:41 -080083 return 0;
84}
85
86static inline int
Florin Coras15531972018-08-12 23:50:53 -070087tls_add_app_q_evt (app_worker_t * app, stream_session_t * app_session)
Florin Coras371ca502018-02-21 12:07:41 -080088{
Florin Coras21795132018-09-09 09:40:51 -070089 return app_worker_lock_and_send_event (app, app_session, FIFO_EVENT_APP_RX);
Florin Coras371ca502018-02-21 12:07:41 -080090}
91
92u32
Florin Coras371ca502018-02-21 12:07:41 -080093tls_listener_ctx_alloc (void)
94{
95 tls_main_t *tm = &tls_main;
96 tls_ctx_t *ctx;
97
98 pool_get (tm->listener_ctx_pool, ctx);
Dave Barachb7b92992018-10-17 10:38:51 -040099 clib_memset (ctx, 0, sizeof (*ctx));
Florin Coras371ca502018-02-21 12:07:41 -0800100 return ctx - tm->listener_ctx_pool;
101}
102
103void
Florin Corase3e2f072018-03-04 07:24:30 -0800104tls_listener_ctx_free (tls_ctx_t * ctx)
Florin Coras371ca502018-02-21 12:07:41 -0800105{
Florin Corasc01d5782018-10-17 14:53:11 -0700106 if (CLIB_DEBUG)
107 memset (ctx, 0xfb, sizeof (*ctx));
Florin Corase3e2f072018-03-04 07:24:30 -0800108 pool_put (tls_main.listener_ctx_pool, ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800109}
110
111tls_ctx_t *
112tls_listener_ctx_get (u32 ctx_index)
113{
114 return pool_elt_at_index (tls_main.listener_ctx_pool, ctx_index);
115}
116
117u32
118tls_listener_ctx_index (tls_ctx_t * ctx)
119{
120 return (ctx - tls_main.listener_ctx_pool);
121}
122
123u32
124tls_ctx_half_open_alloc (void)
125{
126 tls_main_t *tm = &tls_main;
127 u8 will_expand = 0;
128 tls_ctx_t *ctx;
129 u32 ctx_index;
130
131 pool_get_aligned_will_expand (tm->half_open_ctx_pool, will_expand, 0);
132 if (PREDICT_FALSE (will_expand && vlib_num_workers ()))
133 {
134 clib_rwlock_writer_lock (&tm->half_open_rwlock);
135 pool_get (tm->half_open_ctx_pool, ctx);
Florin Coraseb97e5f2018-10-15 21:35:42 -0700136 ctx_index = ctx - tm->half_open_ctx_pool;
Florin Coras371ca502018-02-21 12:07:41 -0800137 clib_rwlock_writer_unlock (&tm->half_open_rwlock);
138 }
139 else
140 {
Ping Yue6446a32018-08-28 18:56:27 -0400141 /* reader lock assumption: only main thread will call pool_get */
142 clib_rwlock_reader_lock (&tm->half_open_rwlock);
Florin Coras371ca502018-02-21 12:07:41 -0800143 pool_get (tm->half_open_ctx_pool, ctx);
Florin Coraseb97e5f2018-10-15 21:35:42 -0700144 ctx_index = ctx - tm->half_open_ctx_pool;
Ping Yue6446a32018-08-28 18:56:27 -0400145 clib_rwlock_reader_unlock (&tm->half_open_rwlock);
Florin Coras371ca502018-02-21 12:07:41 -0800146 }
Dave Barachb7b92992018-10-17 10:38:51 -0400147 clib_memset (ctx, 0, sizeof (*ctx));
Florin Coras371ca502018-02-21 12:07:41 -0800148 return ctx_index;
149}
150
151void
152tls_ctx_half_open_free (u32 ho_index)
153{
154 tls_main_t *tm = &tls_main;
155 clib_rwlock_writer_lock (&tm->half_open_rwlock);
156 pool_put_index (tls_main.half_open_ctx_pool, ho_index);
157 clib_rwlock_writer_unlock (&tm->half_open_rwlock);
158}
159
160tls_ctx_t *
161tls_ctx_half_open_get (u32 ctx_index)
162{
163 tls_main_t *tm = &tls_main;
164 clib_rwlock_reader_lock (&tm->half_open_rwlock);
165 return pool_elt_at_index (tm->half_open_ctx_pool, ctx_index);
166}
167
168void
169tls_ctx_half_open_reader_unlock ()
170{
171 clib_rwlock_reader_unlock (&tls_main.half_open_rwlock);
172}
173
174u32
175tls_ctx_half_open_index (tls_ctx_t * ctx)
176{
177 return (ctx - tls_main.half_open_ctx_pool);
178}
179
Florin Coras58d36f02018-03-09 13:05:53 -0800180void
181tls_notify_app_enqueue (tls_ctx_t * ctx, stream_session_t * app_session)
182{
Florin Coras15531972018-08-12 23:50:53 -0700183 app_worker_t *app;
184 app = app_worker_get_if_valid (app_session->app_wrk_index);
Florin Coras5090c572018-03-18 08:22:17 -0700185 if (PREDICT_TRUE (app != 0))
186 tls_add_app_q_evt (app, app_session);
Florin Coras58d36f02018-03-09 13:05:53 -0800187}
188
189int
Florin Coras371ca502018-02-21 12:07:41 -0800190tls_notify_app_accept (tls_ctx_t * ctx)
191{
192 stream_session_t *app_listener, *app_session;
193 segment_manager_t *sm;
Florin Coras15531972018-08-12 23:50:53 -0700194 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800195 application_t *app;
196 tls_ctx_t *lctx;
197 int rv;
198
Florin Corasef915342018-09-29 10:23:06 -0700199 app_wrk = app_worker_get_if_valid (ctx->parent_app_index);
200 if (!app_wrk)
201 {
202 tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
203 return -1;
204 }
205
Florin Coras15531972018-08-12 23:50:53 -0700206 app = application_get (app_wrk->app_index);
Florin Coras371ca502018-02-21 12:07:41 -0800207 lctx = tls_listener_ctx_get (ctx->listener_ctx_index);
Florin Coras371ca502018-02-21 12:07:41 -0800208
209 app_session = session_alloc (vlib_get_thread_index ());
Florin Coras15531972018-08-12 23:50:53 -0700210 app_session->app_wrk_index = ctx->parent_app_index;
Florin Coras58d36f02018-03-09 13:05:53 -0800211 app_session->connection_index = ctx->tls_ctx_handle;
Ping Yua0c29a92018-08-16 19:11:05 -0400212
213 app_listener = listen_session_get_from_handle (lctx->app_session_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800214 app_session->session_type = app_listener->session_type;
215 app_session->listener_index = app_listener->session_index;
Florin Coras15531972018-08-12 23:50:53 -0700216 sm = app_worker_get_listen_segment_manager (app_wrk, app_listener);
Florin Corasab2f6db2018-08-31 14:31:41 -0700217 app_session->t_app_index = tls_main.app_index;
Florin Coras15531972018-08-12 23:50:53 -0700218
Florin Coras371ca502018-02-21 12:07:41 -0800219 if ((rv = session_alloc_fifos (sm, app_session)))
220 {
221 TLS_DBG (1, "failed to allocate fifos");
222 return rv;
223 }
224 ctx->c_s_index = app_session->session_index;
Florin Coras371ca502018-02-21 12:07:41 -0800225 ctx->app_session_handle = session_handle (app_session);
Florin Corasb5e94e32018-09-14 14:46:39 -0700226 session_lookup_add_connection (&ctx->connection,
227 session_handle (app_session));
Florin Coras371ca502018-02-21 12:07:41 -0800228 return app->cb_fns.session_accept_callback (app_session);
229}
230
Florin Coras58d36f02018-03-09 13:05:53 -0800231int
Florin Coras8f89dd02018-03-05 16:53:07 -0800232tls_notify_app_connected (tls_ctx_t * ctx, u8 is_failed)
Florin Coras371ca502018-02-21 12:07:41 -0800233{
234 int (*cb_fn) (u32, u32, stream_session_t *, u8);
235 stream_session_t *app_session;
236 segment_manager_t *sm;
Florin Coras15531972018-08-12 23:50:53 -0700237 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800238 application_t *app;
239
Florin Corasef915342018-09-29 10:23:06 -0700240 app_wrk = app_worker_get_if_valid (ctx->parent_app_index);
241 if (!app_wrk)
242 {
Florin Corasc01d5782018-10-17 14:53:11 -0700243 tls_disconnect_transport (ctx);
Florin Corasef915342018-09-29 10:23:06 -0700244 return -1;
245 }
246
Florin Coras15531972018-08-12 23:50:53 -0700247 app = application_get (app_wrk->app_index);
Florin Coras371ca502018-02-21 12:07:41 -0800248 cb_fn = app->cb_fns.session_connected_callback;
249
Florin Coras8f89dd02018-03-05 16:53:07 -0800250 if (is_failed)
251 goto failed;
252
Florin Coras15531972018-08-12 23:50:53 -0700253 sm = app_worker_get_connect_segment_manager (app_wrk);
Florin Coras371ca502018-02-21 12:07:41 -0800254 app_session = session_alloc (vlib_get_thread_index ());
Florin Coras15531972018-08-12 23:50:53 -0700255 app_session->app_wrk_index = ctx->parent_app_index;
Florin Coras58d36f02018-03-09 13:05:53 -0800256 app_session->connection_index = ctx->tls_ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800257 app_session->session_type =
258 session_type_from_proto_and_ip (TRANSPORT_PROTO_TLS, ctx->tcp_is_ip4);
Florin Corasab2f6db2018-08-31 14:31:41 -0700259 app_session->t_app_index = tls_main.app_index;
Florin Coras15531972018-08-12 23:50:53 -0700260
Florin Coras371ca502018-02-21 12:07:41 -0800261 if (session_alloc_fifos (sm, app_session))
262 goto failed;
263
264 ctx->app_session_handle = session_handle (app_session);
265 ctx->c_s_index = app_session->session_index;
Florin Corasc01d5782018-10-17 14:53:11 -0700266 app_session->session_state = SESSION_STATE_CONNECTING;
Florin Coras371ca502018-02-21 12:07:41 -0800267 if (cb_fn (ctx->parent_app_index, ctx->parent_app_api_context,
268 app_session, 0 /* not failed */ ))
269 {
270 TLS_DBG (1, "failed to notify app");
Florin Coras58d36f02018-03-09 13:05:53 -0800271 tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
Florin Coraseb97e5f2018-10-15 21:35:42 -0700272 return -1;
Florin Coras371ca502018-02-21 12:07:41 -0800273 }
274
Florin Corasc01d5782018-10-17 14:53:11 -0700275 app_session->session_state = SESSION_STATE_READY;
Florin Corasb5e94e32018-09-14 14:46:39 -0700276 session_lookup_add_connection (&ctx->connection,
277 session_handle (app_session));
278
Florin Coras371ca502018-02-21 12:07:41 -0800279 return 0;
280
281failed:
Florin Coras58d36f02018-03-09 13:05:53 -0800282 tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
Florin Coras371ca502018-02-21 12:07:41 -0800283 return cb_fn (ctx->parent_app_index, ctx->parent_app_api_context, 0,
284 1 /* failed */ );
285}
286
Florin Coras58d36f02018-03-09 13:05:53 -0800287static inline void
288tls_ctx_parse_handle (u32 ctx_handle, u32 * ctx_index, u32 * engine_type)
Florin Corasd77eee62018-03-07 08:49:27 -0800289{
Florin Coras58d36f02018-03-09 13:05:53 -0800290 *ctx_index = ctx_handle & TLS_IDX_MASK;
291 *engine_type = ctx_handle >> TLS_ENGINE_TYPE_SHIFT;
292}
293
294static inline tls_engine_type_t
295tls_get_engine_type (tls_engine_type_t preferred)
296{
297 if (!tls_vfts[preferred].ctx_alloc)
298 return tls_get_available_engine ();
299 return preferred;
300}
301
302static inline u32
303tls_ctx_alloc (tls_engine_type_t engine_type)
304{
305 u32 ctx_index;
306 ctx_index = tls_vfts[engine_type].ctx_alloc ();
307 return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index);
Florin Corasd77eee62018-03-07 08:49:27 -0800308}
309
310static inline void
311tls_ctx_free (tls_ctx_t * ctx)
312{
313 vec_free (ctx->srv_hostname);
Florin Coras58d36f02018-03-09 13:05:53 -0800314 tls_vfts[ctx->tls_ctx_engine].ctx_free (ctx);
Florin Corasd77eee62018-03-07 08:49:27 -0800315}
316
317static inline tls_ctx_t *
Florin Coras58d36f02018-03-09 13:05:53 -0800318tls_ctx_get (u32 ctx_handle)
Florin Corasd77eee62018-03-07 08:49:27 -0800319{
Florin Coras58d36f02018-03-09 13:05:53 -0800320 u32 ctx_index, engine_type;
321 tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type);
322 return tls_vfts[engine_type].ctx_get (ctx_index);
Florin Corasd77eee62018-03-07 08:49:27 -0800323}
324
325static inline tls_ctx_t *
Florin Coras58d36f02018-03-09 13:05:53 -0800326tls_ctx_get_w_thread (u32 ctx_handle, u8 thread_index)
Florin Corasd77eee62018-03-07 08:49:27 -0800327{
Florin Coras58d36f02018-03-09 13:05:53 -0800328 u32 ctx_index, engine_type;
329 tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type);
330 return tls_vfts[engine_type].ctx_get_w_thread (ctx_index, thread_index);
Florin Corasd77eee62018-03-07 08:49:27 -0800331}
332
333static inline int
334tls_ctx_init_server (tls_ctx_t * ctx)
335{
Florin Coras58d36f02018-03-09 13:05:53 -0800336 return tls_vfts[ctx->tls_ctx_engine].ctx_init_server (ctx);
Florin Corasd77eee62018-03-07 08:49:27 -0800337}
338
339static inline int
340tls_ctx_init_client (tls_ctx_t * ctx)
341{
Florin Coras58d36f02018-03-09 13:05:53 -0800342 return tls_vfts[ctx->tls_ctx_engine].ctx_init_client (ctx);
Florin Corasd77eee62018-03-07 08:49:27 -0800343}
344
345static inline int
Florin Coras58d36f02018-03-09 13:05:53 -0800346tls_ctx_write (tls_ctx_t * ctx, stream_session_t * app_session)
Florin Corasd77eee62018-03-07 08:49:27 -0800347{
Florin Coras58d36f02018-03-09 13:05:53 -0800348 return tls_vfts[ctx->tls_ctx_engine].ctx_write (ctx, app_session);
Florin Corasd77eee62018-03-07 08:49:27 -0800349}
350
351static inline int
Florin Coras58d36f02018-03-09 13:05:53 -0800352tls_ctx_read (tls_ctx_t * ctx, stream_session_t * tls_session)
Florin Corasd77eee62018-03-07 08:49:27 -0800353{
Florin Coras58d36f02018-03-09 13:05:53 -0800354 return tls_vfts[ctx->tls_ctx_engine].ctx_read (ctx, tls_session);
Florin Corasd77eee62018-03-07 08:49:27 -0800355}
356
357static inline u8
358tls_ctx_handshake_is_over (tls_ctx_t * ctx)
359{
Florin Coras58d36f02018-03-09 13:05:53 -0800360 return tls_vfts[ctx->tls_ctx_engine].ctx_handshake_is_over (ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800361}
362
363void
364tls_session_reset_callback (stream_session_t * s)
365{
366 clib_warning ("called...");
367}
368
369int
Florin Corasfa76a762018-11-29 12:40:10 -0800370tls_add_segment_callback (u32 client_index, u64 segment_handle)
Florin Coras371ca502018-02-21 12:07:41 -0800371{
372 /* No-op for builtin */
373 return 0;
374}
375
376int
Florin Corasfa76a762018-11-29 12:40:10 -0800377tls_del_segment_callback (u32 client_index, u64 segment_handle)
Florin Coras371ca502018-02-21 12:07:41 -0800378{
379 return 0;
380}
381
382void
383tls_session_disconnect_callback (stream_session_t * tls_session)
384{
385 stream_session_t *app_session;
386 tls_ctx_t *ctx;
Florin Coras15531972018-08-12 23:50:53 -0700387 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800388 application_t *app;
389
390 ctx = tls_ctx_get (tls_session->opaque);
Florin Corasd77eee62018-03-07 08:49:27 -0800391 if (!tls_ctx_handshake_is_over (ctx))
Florin Coras371ca502018-02-21 12:07:41 -0800392 {
Florin Coras5a2ec8f2018-12-27 11:53:11 -0800393 session_close (tls_session);
Florin Coras371ca502018-02-21 12:07:41 -0800394 return;
395 }
396 ctx->is_passive_close = 1;
Florin Coras15531972018-08-12 23:50:53 -0700397 app_wrk = app_worker_get (ctx->parent_app_index);
398 app = application_get (app_wrk->app_index);
Florin Coras371ca502018-02-21 12:07:41 -0800399 app_session = session_get_from_handle (ctx->app_session_handle);
400 app->cb_fns.session_disconnect_callback (app_session);
401}
402
403int
404tls_session_accept_callback (stream_session_t * tls_session)
405{
406 stream_session_t *tls_listener;
407 tls_ctx_t *lctx, *ctx;
Florin Coras58d36f02018-03-09 13:05:53 -0800408 u32 ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800409
Florin Coras5c9083d2018-04-13 06:39:07 -0700410 tls_listener = listen_session_get (tls_session->listener_index);
Florin Coras371ca502018-02-21 12:07:41 -0800411 lctx = tls_listener_ctx_get (tls_listener->opaque);
Florin Coras58d36f02018-03-09 13:05:53 -0800412
413 ctx_handle = tls_ctx_alloc (lctx->tls_ctx_engine);
414 ctx = tls_ctx_get (ctx_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800415 memcpy (ctx, lctx, sizeof (*lctx));
416 ctx->c_thread_index = vlib_get_thread_index ();
Florin Coras58d36f02018-03-09 13:05:53 -0800417 ctx->tls_ctx_handle = ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800418 tls_session->session_state = SESSION_STATE_READY;
Florin Coras58d36f02018-03-09 13:05:53 -0800419 tls_session->opaque = ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800420 ctx->tls_session_handle = session_handle (tls_session);
421 ctx->listener_ctx_index = tls_listener->opaque;
422
Florin Coras58d36f02018-03-09 13:05:53 -0800423 TLS_DBG (1, "Accept on listener %u new connection [%u]%x",
424 tls_listener->opaque, vlib_get_thread_index (), ctx_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800425
426 return tls_ctx_init_server (ctx);
427}
428
429int
430tls_app_tx_callback (stream_session_t * app_session)
431{
Florin Coras371ca502018-02-21 12:07:41 -0800432 tls_ctx_t *ctx;
Florin Coras58d36f02018-03-09 13:05:53 -0800433 if (PREDICT_FALSE (app_session->session_state == SESSION_STATE_CLOSED))
Florin Coras371ca502018-02-21 12:07:41 -0800434 return 0;
Florin Coras58d36f02018-03-09 13:05:53 -0800435 ctx = tls_ctx_get (app_session->connection_index);
436 tls_ctx_write (ctx, app_session);
Florin Coras371ca502018-02-21 12:07:41 -0800437 return 0;
438}
439
440int
441tls_app_rx_callback (stream_session_t * tls_session)
442{
Florin Coras371ca502018-02-21 12:07:41 -0800443 tls_ctx_t *ctx;
Florin Coras371ca502018-02-21 12:07:41 -0800444
445 ctx = tls_ctx_get (tls_session->opaque);
Florin Coras58d36f02018-03-09 13:05:53 -0800446 tls_ctx_read (ctx, tls_session);
447 return 0;
Florin Coras371ca502018-02-21 12:07:41 -0800448}
449
450int
451tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index,
452 stream_session_t * tls_session, u8 is_fail)
453{
Florin Coras371ca502018-02-21 12:07:41 -0800454 tls_ctx_t *ho_ctx, *ctx;
Florin Coras58d36f02018-03-09 13:05:53 -0800455 u32 ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800456
457 ho_ctx = tls_ctx_half_open_get (ho_ctx_index);
Florin Coras371ca502018-02-21 12:07:41 -0800458
459 if (is_fail)
Florin Corasdcde9272018-03-02 09:23:42 -0800460 {
Florin Corasef915342018-09-29 10:23:06 -0700461 int (*cb_fn) (u32, u32, stream_session_t *, u8), rv = 0;
Florin Coras57791ad2018-08-27 10:07:40 -0700462 u32 wrk_index, api_context;
463 app_worker_t *app_wrk;
464 application_t *app;
465
466 wrk_index = ho_ctx->parent_app_index;
Florin Corasef915342018-09-29 10:23:06 -0700467 app_wrk = app_worker_get_if_valid (ho_ctx->parent_app_index);
468 if (app_wrk)
469 {
470 api_context = ho_ctx->c_s_index;
471 app = application_get (app_wrk->app_index);
472 cb_fn = app->cb_fns.session_connected_callback;
473 rv = cb_fn (wrk_index, api_context, 0, 1 /* failed */ );
474 }
Florin Corasdcde9272018-03-02 09:23:42 -0800475 tls_ctx_half_open_reader_unlock ();
476 tls_ctx_half_open_free (ho_ctx_index);
Florin Corasef915342018-09-29 10:23:06 -0700477 return rv;
Florin Corasdcde9272018-03-02 09:23:42 -0800478 }
Florin Coras371ca502018-02-21 12:07:41 -0800479
Florin Coras58d36f02018-03-09 13:05:53 -0800480 ctx_handle = tls_ctx_alloc (ho_ctx->tls_ctx_engine);
481 ctx = tls_ctx_get (ctx_handle);
Dave Barach178cf492018-11-13 16:34:13 -0500482 clib_memcpy_fast (ctx, ho_ctx, sizeof (*ctx));
Florin Coras371ca502018-02-21 12:07:41 -0800483 tls_ctx_half_open_reader_unlock ();
484 tls_ctx_half_open_free (ho_ctx_index);
485
Florin Corasdcde9272018-03-02 09:23:42 -0800486 ctx->c_thread_index = vlib_get_thread_index ();
Florin Coras58d36f02018-03-09 13:05:53 -0800487 ctx->tls_ctx_handle = ctx_handle;
Florin Corasdcde9272018-03-02 09:23:42 -0800488
Florin Coras58d36f02018-03-09 13:05:53 -0800489 TLS_DBG (1, "TCP connect for %u returned %u. New connection [%u]%x",
Florin Coras371ca502018-02-21 12:07:41 -0800490 ho_ctx_index, is_fail, vlib_get_thread_index (),
Florin Coras58d36f02018-03-09 13:05:53 -0800491 (ctx) ? ctx_handle : ~0);
Florin Coras371ca502018-02-21 12:07:41 -0800492
493 ctx->tls_session_handle = session_handle (tls_session);
Florin Coras58d36f02018-03-09 13:05:53 -0800494 tls_session->opaque = ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800495 tls_session->session_state = SESSION_STATE_READY;
496
497 return tls_ctx_init_client (ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800498}
499
500/* *INDENT-OFF* */
501static session_cb_vft_t tls_app_cb_vft = {
502 .session_accept_callback = tls_session_accept_callback,
503 .session_disconnect_callback = tls_session_disconnect_callback,
504 .session_connected_callback = tls_session_connected_callback,
505 .session_reset_callback = tls_session_reset_callback,
506 .add_segment_callback = tls_add_segment_callback,
507 .del_segment_callback = tls_del_segment_callback,
508 .builtin_app_rx_callback = tls_app_rx_callback,
509 .builtin_app_tx_callback = tls_app_tx_callback,
510};
511/* *INDENT-ON* */
512
513int
Florin Coras5665ced2018-10-25 18:03:45 -0700514tls_connect (transport_endpoint_cfg_t * tep)
Florin Coras371ca502018-02-21 12:07:41 -0800515{
Florin Coras15531972018-08-12 23:50:53 -0700516 vnet_connect_args_t _cargs = { {}, }, *cargs = &_cargs;
Florin Coras5665ced2018-10-25 18:03:45 -0700517 session_endpoint_cfg_t *sep;
Florin Coras58d36f02018-03-09 13:05:53 -0800518 tls_engine_type_t engine_type;
Florin Coras371ca502018-02-21 12:07:41 -0800519 tls_main_t *tm = &tls_main;
Florin Coras15531972018-08-12 23:50:53 -0700520 app_worker_t *app_wrk;
521 clib_error_t *error;
Florin Coras371ca502018-02-21 12:07:41 -0800522 application_t *app;
523 tls_ctx_t *ctx;
524 u32 ctx_index;
Florin Coras371ca502018-02-21 12:07:41 -0800525
Florin Coras5665ced2018-10-25 18:03:45 -0700526 sep = (session_endpoint_cfg_t *) tep;
Florin Coras15531972018-08-12 23:50:53 -0700527 app_wrk = app_worker_get (sep->app_wrk_index);
528 app = application_get (app_wrk->app_index);
Florin Coras58d36f02018-03-09 13:05:53 -0800529 engine_type = tls_get_engine_type (app->tls_engine);
530 if (engine_type == TLS_ENGINE_NONE)
531 {
532 clib_warning ("No tls engine_type available");
533 return -1;
534 }
Florin Coras371ca502018-02-21 12:07:41 -0800535
536 ctx_index = tls_ctx_half_open_alloc ();
537 ctx = tls_ctx_half_open_get (ctx_index);
Florin Coras15531972018-08-12 23:50:53 -0700538 ctx->parent_app_index = sep->app_wrk_index;
Florin Coras371ca502018-02-21 12:07:41 -0800539 ctx->parent_app_api_context = sep->opaque;
540 ctx->tcp_is_ip4 = sep->is_ip4;
Florin Coras8f89dd02018-03-05 16:53:07 -0800541 if (sep->hostname)
542 {
543 ctx->srv_hostname = format (0, "%v", sep->hostname);
544 vec_terminate_c_string (ctx->srv_hostname);
545 }
Florin Coras371ca502018-02-21 12:07:41 -0800546 tls_ctx_half_open_reader_unlock ();
547
Florin Coras15531972018-08-12 23:50:53 -0700548 app_worker_alloc_connects_segment_manager (app_wrk);
Florin Coras58d36f02018-03-09 13:05:53 -0800549 ctx->tls_ctx_engine = engine_type;
Florin Coras371ca502018-02-21 12:07:41 -0800550
Dave Barach178cf492018-11-13 16:34:13 -0500551 clib_memcpy_fast (&cargs->sep, sep, sizeof (session_endpoint_t));
Florin Coras15531972018-08-12 23:50:53 -0700552 cargs->sep.transport_proto = TRANSPORT_PROTO_TCP;
553 cargs->app_index = tm->app_index;
554 cargs->api_context = ctx_index;
555 if ((error = vnet_connect (cargs)))
556 return clib_error_get_code (error);
Florin Coras371ca502018-02-21 12:07:41 -0800557
Florin Coras58d36f02018-03-09 13:05:53 -0800558 TLS_DBG (1, "New connect request %u engine %d", ctx_index, engine_type);
Florin Coras371ca502018-02-21 12:07:41 -0800559 return 0;
560}
561
562void
Florin Coras58d36f02018-03-09 13:05:53 -0800563tls_disconnect (u32 ctx_handle, u32 thread_index)
Florin Coras371ca502018-02-21 12:07:41 -0800564{
Florin Coras371ca502018-02-21 12:07:41 -0800565 tls_ctx_t *ctx;
566
Florin Coras58d36f02018-03-09 13:05:53 -0800567 TLS_DBG (1, "Disconnecting %x", ctx_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800568
Florin Coras58d36f02018-03-09 13:05:53 -0800569 ctx = tls_ctx_get (ctx_handle);
Florin Corasc01d5782018-10-17 14:53:11 -0700570 tls_disconnect_transport (ctx);
Florin Coras5a2ec8f2018-12-27 11:53:11 -0800571 session_transport_delete_notify (&ctx->connection);
Florin Coras371ca502018-02-21 12:07:41 -0800572 tls_ctx_free (ctx);
573}
574
575u32
576tls_start_listen (u32 app_listener_index, transport_endpoint_t * tep)
577{
Florin Coras74cac882018-09-07 09:13:15 -0700578 vnet_bind_args_t _bargs, *args = &_bargs;
Florin Corasab2f6db2018-08-31 14:31:41 -0700579 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800580 tls_main_t *tm = &tls_main;
Florin Coras371ca502018-02-21 12:07:41 -0800581 session_handle_t tls_handle;
Florin Coras5665ced2018-10-25 18:03:45 -0700582 session_endpoint_cfg_t *sep;
Florin Coras371ca502018-02-21 12:07:41 -0800583 stream_session_t *tls_listener;
Florin Coras371ca502018-02-21 12:07:41 -0800584 stream_session_t *app_listener;
Florin Coras58d36f02018-03-09 13:05:53 -0800585 tls_engine_type_t engine_type;
Florin Coras74cac882018-09-07 09:13:15 -0700586 application_t *app;
Florin Coras15531972018-08-12 23:50:53 -0700587 tls_ctx_t *lctx;
588 u32 lctx_index;
Florin Coras371ca502018-02-21 12:07:41 -0800589
Florin Coras5665ced2018-10-25 18:03:45 -0700590 sep = (session_endpoint_cfg_t *) tep;
Florin Coras15531972018-08-12 23:50:53 -0700591 app_wrk = app_worker_get (sep->app_wrk_index);
592 app = application_get (app_wrk->app_index);
Florin Coras58d36f02018-03-09 13:05:53 -0800593 engine_type = tls_get_engine_type (app->tls_engine);
594 if (engine_type == TLS_ENGINE_NONE)
595 {
596 clib_warning ("No tls engine_type available");
597 return -1;
598 }
599
Florin Coras371ca502018-02-21 12:07:41 -0800600 sep->transport_proto = TRANSPORT_PROTO_TCP;
Dave Barachb7b92992018-10-17 10:38:51 -0400601 clib_memset (args, 0, sizeof (*args));
Florin Coras74cac882018-09-07 09:13:15 -0700602 args->app_index = tm->app_index;
603 args->sep_ext = *sep;
604 if (vnet_bind (args))
605 return -1;
Florin Coras371ca502018-02-21 12:07:41 -0800606
Florin Coras74cac882018-09-07 09:13:15 -0700607 tls_handle = args->handle;
608 lctx_index = tls_listener_ctx_alloc ();
Florin Coras371ca502018-02-21 12:07:41 -0800609 tls_listener = listen_session_get_from_handle (tls_handle);
610 tls_listener->opaque = lctx_index;
Florin Coras58d36f02018-03-09 13:05:53 -0800611
Florin Coras5c9083d2018-04-13 06:39:07 -0700612 app_listener = listen_session_get (app_listener_index);
Florin Coras58d36f02018-03-09 13:05:53 -0800613
614 lctx = tls_listener_ctx_get (lctx_index);
Florin Coras15531972018-08-12 23:50:53 -0700615 lctx->parent_app_index = sep->app_wrk_index;
Florin Coras371ca502018-02-21 12:07:41 -0800616 lctx->tls_session_handle = tls_handle;
617 lctx->app_session_handle = listen_session_get_handle (app_listener);
618 lctx->tcp_is_ip4 = sep->is_ip4;
Florin Coras58d36f02018-03-09 13:05:53 -0800619 lctx->tls_ctx_engine = engine_type;
620
Ping Yudecda5b2018-08-13 06:20:00 -0400621 tls_vfts[engine_type].ctx_start_listen (lctx);
622
Florin Coras58d36f02018-03-09 13:05:53 -0800623 TLS_DBG (1, "Started listening %d, engine type %d", lctx_index,
624 engine_type);
Florin Coras371ca502018-02-21 12:07:41 -0800625 return lctx_index;
626}
627
628u32
Florin Corase3e2f072018-03-04 07:24:30 -0800629tls_stop_listen (u32 lctx_index)
Florin Coras371ca502018-02-21 12:07:41 -0800630{
Ping Yudecda5b2018-08-13 06:20:00 -0400631 tls_engine_type_t engine_type;
Florin Corasb5e94e32018-09-14 14:46:39 -0700632 tls_ctx_t *lctx;
Ping Yudecda5b2018-08-13 06:20:00 -0400633
Florin Corase3e2f072018-03-04 07:24:30 -0800634 lctx = tls_listener_ctx_get (lctx_index);
Florin Corasb5e94e32018-09-14 14:46:39 -0700635 vnet_unbind_args_t a = {
636 .handle = lctx->tls_session_handle,
637 .app_index = tls_main.app_index,
638 .wrk_map_index = 0 /* default wrk */
639 };
640 if (vnet_unbind (&a))
641 clib_warning ("unbind returned");
642
Ping Yudecda5b2018-08-13 06:20:00 -0400643 engine_type = lctx->tls_ctx_engine;
644 tls_vfts[engine_type].ctx_stop_listen (lctx);
645
Florin Corase3e2f072018-03-04 07:24:30 -0800646 tls_listener_ctx_free (lctx);
Florin Coras371ca502018-02-21 12:07:41 -0800647 return 0;
648}
649
650transport_connection_t *
Florin Corase3e2f072018-03-04 07:24:30 -0800651tls_connection_get (u32 ctx_index, u32 thread_index)
652{
653 tls_ctx_t *ctx;
654 ctx = tls_ctx_get_w_thread (ctx_index, thread_index);
655 return &ctx->connection;
656}
657
658transport_connection_t *
Florin Coras371ca502018-02-21 12:07:41 -0800659tls_listener_get (u32 listener_index)
660{
661 tls_ctx_t *ctx;
662 ctx = tls_listener_ctx_get (listener_index);
663 return &ctx->connection;
664}
665
666u8 *
667format_tls_ctx (u8 * s, va_list * args)
668{
669 tls_ctx_t *ctx = va_arg (*args, tls_ctx_t *);
670 u32 thread_index = va_arg (*args, u32);
671 u32 child_si, child_ti;
672
673 session_parse_handle (ctx->tls_session_handle, &child_si, &child_ti);
674 if (thread_index != child_ti)
675 clib_warning ("app and tls sessions are on different threads!");
676
Florin Corase3e2f072018-03-04 07:24:30 -0800677 s = format (s, "[#%d][TLS] app %u child %u", child_ti,
678 ctx->parent_app_index, child_si);
Florin Coras371ca502018-02-21 12:07:41 -0800679 return s;
680}
681
682u8 *
683format_tls_connection (u8 * s, va_list * args)
684{
685 u32 ctx_index = va_arg (*args, u32);
686 u32 thread_index = va_arg (*args, u32);
687 u32 verbose = va_arg (*args, u32);
688 tls_ctx_t *ctx;
689
690 ctx = tls_ctx_get_w_thread (ctx_index, thread_index);
691 if (!ctx)
692 return s;
693
694 s = format (s, "%-50U", format_tls_ctx, ctx, thread_index);
695 if (verbose)
696 {
Florin Corasef915342018-09-29 10:23:06 -0700697 stream_session_t *ts;
698 ts = session_get_from_handle (ctx->app_session_handle);
699 s = format (s, "state: %-7u", ts->session_state);
Florin Coras371ca502018-02-21 12:07:41 -0800700 if (verbose > 1)
701 s = format (s, "\n");
702 }
703 return s;
704}
705
706u8 *
707format_tls_listener (u8 * s, va_list * args)
708{
709 u32 tc_index = va_arg (*args, u32);
710 tls_ctx_t *ctx = tls_listener_ctx_get (tc_index);
Florin Coras5c9083d2018-04-13 06:39:07 -0700711 u32 listener_index, thread_index;
Florin Coras371ca502018-02-21 12:07:41 -0800712
Florin Coras5c9083d2018-04-13 06:39:07 -0700713 listen_session_parse_handle (ctx->tls_session_handle, &listener_index,
714 &thread_index);
Florin Coras371ca502018-02-21 12:07:41 -0800715 return format (s, "[TLS] listener app %u child %u", ctx->parent_app_index,
716 listener_index);
717}
718
719u8 *
720format_tls_half_open (u8 * s, va_list * args)
721{
722 u32 tc_index = va_arg (*args, u32);
723 tls_ctx_t *ctx = tls_ctx_half_open_get (tc_index);
724 s = format (s, "[TLS] half-open app %u", ctx->parent_app_index);
725 tls_ctx_half_open_reader_unlock ();
726 return s;
727}
728
729/* *INDENT-OFF* */
730const static transport_proto_vft_t tls_proto = {
731 .open = tls_connect,
732 .close = tls_disconnect,
733 .bind = tls_start_listen,
Florin Corase3e2f072018-03-04 07:24:30 -0800734 .get_connection = tls_connection_get,
Florin Coras371ca502018-02-21 12:07:41 -0800735 .get_listener = tls_listener_get,
736 .unbind = tls_stop_listen,
737 .tx_type = TRANSPORT_TX_INTERNAL,
738 .service_type = TRANSPORT_SERVICE_APP,
739 .format_connection = format_tls_connection,
740 .format_half_open = format_tls_half_open,
741 .format_listener = format_tls_listener,
742};
743/* *INDENT-ON* */
744
Florin Corasd77eee62018-03-07 08:49:27 -0800745void
746tls_register_engine (const tls_engine_vft_t * vft, tls_engine_type_t type)
Florin Coras371ca502018-02-21 12:07:41 -0800747{
Florin Corasd77eee62018-03-07 08:49:27 -0800748 vec_validate (tls_vfts, type);
749 tls_vfts[type] = *vft;
Florin Coras371ca502018-02-21 12:07:41 -0800750}
751
Dave Barachcc5677b2018-03-28 19:08:45 -0400752static clib_error_t *
Florin Coras371ca502018-02-21 12:07:41 -0800753tls_init (vlib_main_t * vm)
754{
Florin Coras58d36f02018-03-09 13:05:53 -0800755 vlib_thread_main_t *vtm = vlib_get_thread_main ();
Florin Coras371ca502018-02-21 12:07:41 -0800756 vnet_app_attach_args_t _a, *a = &_a;
757 u64 options[APP_OPTIONS_N_OPTIONS];
758 u32 segment_size = 512 << 20;
759 tls_main_t *tm = &tls_main;
Florin Corasd77eee62018-03-07 08:49:27 -0800760 u32 fifo_size = 64 << 10;
Florin Coras58d36f02018-03-09 13:05:53 -0800761 u32 num_threads;
762
763 num_threads = 1 /* main thread */ + vtm->n_threads;
Florin Coras371ca502018-02-21 12:07:41 -0800764
Dave Barachb7b92992018-10-17 10:38:51 -0400765 clib_memset (a, 0, sizeof (*a));
766 clib_memset (options, 0, sizeof (options));
Florin Coras371ca502018-02-21 12:07:41 -0800767
768 a->session_cb_vft = &tls_app_cb_vft;
Florin Coras0bee9ce2018-03-22 21:24:31 -0700769 a->api_client_index = APP_INVALID_INDEX;
Florin Coras371ca502018-02-21 12:07:41 -0800770 a->options = options;
Florin Coras0bee9ce2018-03-22 21:24:31 -0700771 a->name = format (0, "tls");
Florin Coras371ca502018-02-21 12:07:41 -0800772 a->options[APP_OPTIONS_SEGMENT_SIZE] = segment_size;
773 a->options[APP_OPTIONS_RX_FIFO_SIZE] = fifo_size;
774 a->options[APP_OPTIONS_TX_FIFO_SIZE] = fifo_size;
775 a->options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
776 a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
Florin Corasda3eec12018-09-07 13:29:17 -0700777 a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_TRANSPORT_APP;
Florin Coras371ca502018-02-21 12:07:41 -0800778
779 if (vnet_application_attach (a))
780 {
781 clib_warning ("failed to attach tls app");
782 return clib_error_return (0, "failed to attach tls app");
783 }
784
Florin Corasd77eee62018-03-07 08:49:27 -0800785 if (!tm->ca_cert_path)
786 tm->ca_cert_path = TLS_CA_CERT_PATH;
787
Florin Coras371ca502018-02-21 12:07:41 -0800788 tm->app_index = a->app_index;
Florin Coras371ca502018-02-21 12:07:41 -0800789 clib_rwlock_init (&tm->half_open_rwlock);
790
Florin Coras58d36f02018-03-09 13:05:53 -0800791 vec_validate (tm->rx_bufs, num_threads - 1);
792 vec_validate (tm->tx_bufs, num_threads - 1);
793
Florin Coras371ca502018-02-21 12:07:41 -0800794 transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto,
795 FIB_PROTOCOL_IP4, ~0);
796 transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto,
797 FIB_PROTOCOL_IP6, ~0);
Florin Coras0bee9ce2018-03-22 21:24:31 -0700798 vec_free (a->name);
Florin Coras371ca502018-02-21 12:07:41 -0800799 return 0;
800}
801
802VLIB_INIT_FUNCTION (tls_init);
803
Florin Coras8f89dd02018-03-05 16:53:07 -0800804static clib_error_t *
805tls_config_fn (vlib_main_t * vm, unformat_input_t * input)
806{
807 tls_main_t *tm = &tls_main;
808 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
809 {
810 if (unformat (input, "use-test-cert-in-ca"))
811 tm->use_test_cert_in_ca = 1;
812 else if (unformat (input, "ca-cert-path %s", &tm->ca_cert_path))
813 ;
814 else
815 return clib_error_return (0, "unknown input `%U'",
816 format_unformat_error, input);
817 }
818 return 0;
819}
820
821VLIB_EARLY_CONFIG_FUNCTION (tls_config_fn, "tls");
Florin Corasd77eee62018-03-07 08:49:27 -0800822
823tls_main_t *
824vnet_tls_get_main (void)
825{
826 return &tls_main;
827}
828
Florin Coras371ca502018-02-21 12:07:41 -0800829/*
830 * fd.io coding-style-patch-verification: ON
831 *
832 * Local Variables:
833 * eval: (c-set-style "gnu")
834 * End:
835 */