blob: aca8c9f16a393a01cb28b70d973b9cccd10b5ac9 [file] [log] [blame]
Florin Coras371ca502018-02-21 12:07:41 -08001/*
Florin Corasc9940fc2019-02-05 20:55:11 -08002 * Copyright (c) 2018-2019 Cisco and/or its affiliates.
Florin Coras371ca502018-02-21 12:07:41 -08003 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16#include <vnet/session/application_interface.h>
17#include <vppinfra/lock.h>
Florin Corasd77eee62018-03-07 08:49:27 -080018#include <vnet/tls/tls.h>
Florin Coras371ca502018-02-21 12:07:41 -080019
20static tls_main_t tls_main;
Florin Corasd77eee62018-03-07 08:49:27 -080021static tls_engine_vft_t *tls_vfts;
Florin Coras371ca502018-02-21 12:07:41 -080022
Florin Coras58d36f02018-03-09 13:05:53 -080023#define TLS_INVALID_HANDLE ~0
24#define TLS_IDX_MASK 0x00FFFFFF
jxm975fde82021-06-17 04:44:40 +000025#define TLS_ENGINE_TYPE_SHIFT 28
Florin Coras58d36f02018-03-09 13:05:53 -080026
27void tls_disconnect (u32 ctx_handle, u32 thread_index);
28
Florin Coras06a6a302019-04-17 14:19:12 -070029void
Florin Corasc01d5782018-10-17 14:53:11 -070030tls_disconnect_transport (tls_ctx_t * ctx)
31{
32 vnet_disconnect_args_t a = {
33 .handle = ctx->tls_session_handle,
34 .app_index = tls_main.app_index,
35 };
36
37 if (vnet_disconnect_session (&a))
38 clib_warning ("disconnect returned");
39}
40
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +020041crypto_engine_type_t
Florin Coras58d36f02018-03-09 13:05:53 -080042tls_get_available_engine (void)
43{
44 int i;
45 for (i = 0; i < vec_len (tls_vfts); i++)
46 {
47 if (tls_vfts[i].ctx_alloc)
48 return i;
49 }
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +020050 return CRYPTO_ENGINE_NONE;
Florin Coras58d36f02018-03-09 13:05:53 -080051}
Florin Coras371ca502018-02-21 12:07:41 -080052
Florin Corasd77eee62018-03-07 08:49:27 -080053int
Florin Coras288eaab2019-02-03 15:26:14 -080054tls_add_vpp_q_rx_evt (session_t * s)
Florin Coras371ca502018-02-21 12:07:41 -080055{
Florin Coras288eaab2019-02-03 15:26:14 -080056 if (svm_fifo_set_event (s->rx_fifo))
Florin Corasfe97da32019-03-06 10:09:04 -080057 session_send_io_evt_to_thread (s->rx_fifo, SESSION_IO_EVT_RX);
Florin Corasef915342018-09-29 10:23:06 -070058 return 0;
59}
60
61int
Florin Coras288eaab2019-02-03 15:26:14 -080062tls_add_vpp_q_builtin_rx_evt (session_t * s)
Florin Corasef915342018-09-29 10:23:06 -070063{
Florin Coras0242d302022-12-22 15:03:44 -080064 session_enqueue_notify (s);
Florin Corasef915342018-09-29 10:23:06 -070065 return 0;
66}
67
68int
Florin Coras288eaab2019-02-03 15:26:14 -080069tls_add_vpp_q_tx_evt (session_t * s)
Florin Corasef915342018-09-29 10:23:06 -070070{
Florin Coras288eaab2019-02-03 15:26:14 -080071 if (svm_fifo_set_event (s->tx_fifo))
Florin Corasfe97da32019-03-06 10:09:04 -080072 session_send_io_evt_to_thread (s->tx_fifo, SESSION_IO_EVT_TX);
Florin Corasef915342018-09-29 10:23:06 -070073 return 0;
74}
75
Florin Coras371ca502018-02-21 12:07:41 -080076static inline int
Florin Coras0242d302022-12-22 15:03:44 -080077tls_add_app_q_evt (app_worker_t *app_wrk, session_t *app_session)
Florin Coras371ca502018-02-21 12:07:41 -080078{
Florin Coras0242d302022-12-22 15:03:44 -080079 app_worker_add_event (app_wrk, app_session, SESSION_IO_EVT_RX);
80 return 0;
Florin Coras371ca502018-02-21 12:07:41 -080081}
82
83u32
Florin Coras371ca502018-02-21 12:07:41 -080084tls_listener_ctx_alloc (void)
85{
86 tls_main_t *tm = &tls_main;
87 tls_ctx_t *ctx;
88
89 pool_get (tm->listener_ctx_pool, ctx);
Dave Barachb7b92992018-10-17 10:38:51 -040090 clib_memset (ctx, 0, sizeof (*ctx));
Florin Coras371ca502018-02-21 12:07:41 -080091 return ctx - tm->listener_ctx_pool;
92}
93
94void
Florin Corase3e2f072018-03-04 07:24:30 -080095tls_listener_ctx_free (tls_ctx_t * ctx)
Florin Coras371ca502018-02-21 12:07:41 -080096{
Florin Corasc01d5782018-10-17 14:53:11 -070097 if (CLIB_DEBUG)
98 memset (ctx, 0xfb, sizeof (*ctx));
Florin Corase3e2f072018-03-04 07:24:30 -080099 pool_put (tls_main.listener_ctx_pool, ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800100}
101
102tls_ctx_t *
103tls_listener_ctx_get (u32 ctx_index)
104{
105 return pool_elt_at_index (tls_main.listener_ctx_pool, ctx_index);
106}
107
108u32
109tls_listener_ctx_index (tls_ctx_t * ctx)
110{
111 return (ctx - tls_main.listener_ctx_pool);
112}
113
114u32
115tls_ctx_half_open_alloc (void)
116{
117 tls_main_t *tm = &tls_main;
Florin Coras371ca502018-02-21 12:07:41 -0800118 tls_ctx_t *ctx;
Florin Coras371ca502018-02-21 12:07:41 -0800119
Florin Coras009303d2022-03-29 17:49:37 -0700120 pool_get_aligned_safe (tm->half_open_ctx_pool, ctx, CLIB_CACHE_LINE_BYTES);
121
122 clib_memset (ctx, 0, sizeof (*ctx));
123 ctx->c_c_index = ctx - tm->half_open_ctx_pool;
Florin Coras309f7aa2022-03-18 08:33:08 -0700124 ctx->c_thread_index = transport_cl_thread ();
Florin Coras009303d2022-03-29 17:49:37 -0700125
126 return ctx->c_c_index;
Florin Coras371ca502018-02-21 12:07:41 -0800127}
128
129void
130tls_ctx_half_open_free (u32 ho_index)
131{
Florin Coras371ca502018-02-21 12:07:41 -0800132 pool_put_index (tls_main.half_open_ctx_pool, ho_index);
Florin Coras371ca502018-02-21 12:07:41 -0800133}
134
135tls_ctx_t *
136tls_ctx_half_open_get (u32 ctx_index)
137{
138 tls_main_t *tm = &tls_main;
Florin Coras371ca502018-02-21 12:07:41 -0800139 return pool_elt_at_index (tm->half_open_ctx_pool, ctx_index);
140}
141
142void
Florin Coras288eaab2019-02-03 15:26:14 -0800143tls_notify_app_enqueue (tls_ctx_t * ctx, session_t * app_session)
Florin Coras58d36f02018-03-09 13:05:53 -0800144{
Florin Corasbf7ce2c2019-03-06 14:44:42 -0800145 app_worker_t *app_wrk;
146 app_wrk = app_worker_get_if_valid (app_session->app_wrk_index);
147 if (PREDICT_TRUE (app_wrk != 0))
148 tls_add_app_q_evt (app_wrk, app_session);
Florin Coras58d36f02018-03-09 13:05:53 -0800149}
150
151int
Florin Coras371ca502018-02-21 12:07:41 -0800152tls_notify_app_accept (tls_ctx_t * ctx)
153{
Florin Coras288eaab2019-02-03 15:26:14 -0800154 session_t *app_listener, *app_session;
Florin Coras15531972018-08-12 23:50:53 -0700155 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800156 tls_ctx_t *lctx;
157 int rv;
158
Florin Coras371ca502018-02-21 12:07:41 -0800159 lctx = tls_listener_ctx_get (ctx->listener_ctx_index);
Florin Corasa27a46e2019-02-18 13:02:28 -0800160 app_listener = listen_session_get_from_handle (lctx->app_session_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800161
Florin Coras58a93e82019-01-14 23:33:46 -0800162 app_session = session_get (ctx->c_s_index, ctx->c_thread_index);
Florin Corasdf57ea02019-02-18 20:14:20 -0800163 app_session->app_wrk_index = ctx->parent_app_wrk_index;
Florin Coras58d36f02018-03-09 13:05:53 -0800164 app_session->connection_index = ctx->tls_ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800165 app_session->session_type = app_listener->session_type;
Nathan Skrzypczak2f0f96b2019-06-13 10:14:28 +0200166 app_session->listener_handle = listen_session_get_handle (app_listener);
Florin Coras8a140612019-02-18 22:39:39 -0800167 app_session->session_state = SESSION_STATE_ACCEPTING;
Florin Coras15531972018-08-12 23:50:53 -0700168
Florin Corasa27a46e2019-02-18 13:02:28 -0800169 if ((rv = app_worker_init_accepted (app_session)))
Florin Coras371ca502018-02-21 12:07:41 -0800170 {
171 TLS_DBG (1, "failed to allocate fifos");
Florin Corasa27a46e2019-02-18 13:02:28 -0800172 session_free (app_session);
Florin Coras371ca502018-02-21 12:07:41 -0800173 return rv;
174 }
Florin Coras371ca502018-02-21 12:07:41 -0800175 ctx->app_session_handle = session_handle (app_session);
Florin Corasdf57ea02019-02-18 20:14:20 -0800176 ctx->parent_app_wrk_index = app_session->app_wrk_index;
Florin Corasa27a46e2019-02-18 13:02:28 -0800177 app_wrk = app_worker_get (app_session->app_wrk_index);
178 return app_worker_accept_notify (app_wrk, app_session);
Florin Coras371ca502018-02-21 12:07:41 -0800179}
180
Florin Coras58d36f02018-03-09 13:05:53 -0800181int
Florin Coras00e01d32019-10-21 16:07:46 -0700182tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err)
Florin Coras371ca502018-02-21 12:07:41 -0800183{
Florin Coras179711d2022-04-10 13:34:47 -0700184 u32 parent_app_api_ctx;
Florin Coras288eaab2019-02-03 15:26:14 -0800185 session_t *app_session;
Florin Coras15531972018-08-12 23:50:53 -0700186 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800187
Florin Corasdf57ea02019-02-18 20:14:20 -0800188 app_wrk = app_worker_get_if_valid (ctx->parent_app_wrk_index);
Florin Corasef915342018-09-29 10:23:06 -0700189 if (!app_wrk)
190 {
Florin Coras179711d2022-04-10 13:34:47 -0700191 if (ctx->tls_type == TRANSPORT_PROTO_TLS)
192 session_free (session_get (ctx->c_s_index, ctx->c_thread_index));
193 ctx->no_app_session = 1;
Florin Corasef915342018-09-29 10:23:06 -0700194 return -1;
195 }
196
Florin Coras00e01d32019-10-21 16:07:46 -0700197 if (err)
Florin Coras4b47ee22020-11-19 13:38:26 -0800198 {
199 /* Free app session pre-allocated when transport was established */
200 if (ctx->tls_type == TRANSPORT_PROTO_TLS)
201 session_free (session_get (ctx->c_s_index, ctx->c_thread_index));
Florin Corase3c6a542021-05-19 19:28:40 -0700202 ctx->no_app_session = 1;
203 goto send_reply;
Florin Coras4b47ee22020-11-19 13:38:26 -0800204 }
Florin Coras8f89dd02018-03-05 16:53:07 -0800205
Florin Coras4b47ee22020-11-19 13:38:26 -0800206 /* For DTLS the app session is not preallocated because the underlying udp
207 * session might migrate to a different worker during the handshake */
208 if (ctx->tls_type == TRANSPORT_PROTO_DTLS)
209 {
210 session_type_t st;
Florin Corasbab6c522021-05-13 08:36:56 -0700211 /* Cleanup half-open session as we don't get notification from udp */
212 session_half_open_delete_notify (&ctx->connection);
Florin Coras4b47ee22020-11-19 13:38:26 -0800213 app_session = session_alloc (ctx->c_thread_index);
214 app_session->session_state = SESSION_STATE_CREATED;
215 ctx->c_s_index = app_session->session_index;
216 st =
217 session_type_from_proto_and_ip (TRANSPORT_PROTO_DTLS, ctx->tcp_is_ip4);
218 app_session->session_type = st;
219 app_session->connection_index = ctx->tls_ctx_handle;
220 }
221 else
222 {
223 app_session = session_get (ctx->c_s_index, ctx->c_thread_index);
224 }
225
Florin Corasdf57ea02019-02-18 20:14:20 -0800226 app_session->app_wrk_index = ctx->parent_app_wrk_index;
Florin Coras2ceb8182023-08-31 17:33:47 -0700227 app_session->opaque = ctx->parent_app_api_context;
Florin Coras15531972018-08-12 23:50:53 -0700228
Florin Coras00e01d32019-10-21 16:07:46 -0700229 if ((err = app_worker_init_connected (app_wrk, app_session)))
Florin Corasa3d55df2023-10-06 19:06:35 -0700230 {
231 app_worker_connect_notify (app_wrk, 0, err, ctx->parent_app_api_context);
232 ctx->no_app_session = 1;
233 session_free (app_session);
234 return -1;
235 }
Florin Coras371ca502018-02-21 12:07:41 -0800236
jiangxiaoming5b7ea912020-09-23 10:29:21 +0800237 app_session->session_state = SESSION_STATE_READY;
Florin Coras179711d2022-04-10 13:34:47 -0700238 parent_app_api_ctx = ctx->parent_app_api_context;
239 ctx->app_session_handle = session_handle (app_session);
240
241 if (app_worker_connect_notify (app_wrk, app_session, SESSION_E_NONE,
242 parent_app_api_ctx))
Florin Coras371ca502018-02-21 12:07:41 -0800243 {
244 TLS_DBG (1, "failed to notify app");
Florin Coras6e7ebb02022-05-04 12:02:56 -0700245 session_free (session_get (ctx->c_s_index, ctx->c_thread_index));
246 ctx->no_app_session = 1;
Florin Coraseb97e5f2018-10-15 21:35:42 -0700247 return -1;
Florin Coras371ca502018-02-21 12:07:41 -0800248 }
249
250 return 0;
251
Florin Corase3c6a542021-05-19 19:28:40 -0700252send_reply:
Florin Coras00e01d32019-10-21 16:07:46 -0700253 return app_worker_connect_notify (app_wrk, 0, err,
254 ctx->parent_app_api_context);
Florin Coras371ca502018-02-21 12:07:41 -0800255}
256
Florin Coras58d36f02018-03-09 13:05:53 -0800257static inline void
258tls_ctx_parse_handle (u32 ctx_handle, u32 * ctx_index, u32 * engine_type)
Florin Corasd77eee62018-03-07 08:49:27 -0800259{
Florin Coras58d36f02018-03-09 13:05:53 -0800260 *ctx_index = ctx_handle & TLS_IDX_MASK;
261 *engine_type = ctx_handle >> TLS_ENGINE_TYPE_SHIFT;
262}
263
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200264static inline crypto_engine_type_t
Florin Corasa54b62d2021-04-21 09:05:56 -0700265tls_get_engine_type (crypto_engine_type_t requested,
266 crypto_engine_type_t preferred)
Florin Coras58d36f02018-03-09 13:05:53 -0800267{
Florin Corasa54b62d2021-04-21 09:05:56 -0700268 if (requested != CRYPTO_ENGINE_NONE)
269 {
270 if (tls_vfts[requested].ctx_alloc)
271 return requested;
272 return CRYPTO_ENGINE_NONE;
273 }
Florin Coras58d36f02018-03-09 13:05:53 -0800274 if (!tls_vfts[preferred].ctx_alloc)
275 return tls_get_available_engine ();
276 return preferred;
277}
278
279static inline u32
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200280tls_ctx_alloc (crypto_engine_type_t engine_type)
Florin Coras58d36f02018-03-09 13:05:53 -0800281{
282 u32 ctx_index;
283 ctx_index = tls_vfts[engine_type].ctx_alloc ();
284 return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index);
Florin Corasd77eee62018-03-07 08:49:27 -0800285}
286
Florin Coras4b47ee22020-11-19 13:38:26 -0800287static inline u32
288tls_ctx_alloc_w_thread (crypto_engine_type_t engine_type, u32 thread_index)
289{
290 u32 ctx_index;
291 ctx_index = tls_vfts[engine_type].ctx_alloc_w_thread (thread_index);
292 return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index);
293}
294
295static inline u32
296tls_ctx_attach (crypto_engine_type_t engine_type, u32 thread_index, void *ctx)
297{
298 u32 ctx_index;
299 ctx_index = tls_vfts[engine_type].ctx_attach (thread_index, ctx);
300 return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index);
301}
302
303static inline void *
304tls_ctx_detach (tls_ctx_t *ctx)
305{
306 return tls_vfts[ctx->tls_ctx_engine].ctx_detach (ctx);
307}
308
Florin Corasd77eee62018-03-07 08:49:27 -0800309static inline tls_ctx_t *
Florin Coras58d36f02018-03-09 13:05:53 -0800310tls_ctx_get (u32 ctx_handle)
Florin Corasd77eee62018-03-07 08:49:27 -0800311{
Florin Coras58d36f02018-03-09 13:05:53 -0800312 u32 ctx_index, engine_type;
313 tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type);
314 return tls_vfts[engine_type].ctx_get (ctx_index);
Florin Corasd77eee62018-03-07 08:49:27 -0800315}
316
317static inline tls_ctx_t *
Florin Coras58d36f02018-03-09 13:05:53 -0800318tls_ctx_get_w_thread (u32 ctx_handle, u8 thread_index)
Florin Corasd77eee62018-03-07 08:49:27 -0800319{
Florin Coras58d36f02018-03-09 13:05:53 -0800320 u32 ctx_index, engine_type;
321 tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type);
322 return tls_vfts[engine_type].ctx_get_w_thread (ctx_index, thread_index);
Florin Corasd77eee62018-03-07 08:49:27 -0800323}
324
325static inline int
326tls_ctx_init_server (tls_ctx_t * ctx)
327{
Florin Coras58d36f02018-03-09 13:05:53 -0800328 return tls_vfts[ctx->tls_ctx_engine].ctx_init_server (ctx);
Florin Corasd77eee62018-03-07 08:49:27 -0800329}
330
331static inline int
332tls_ctx_init_client (tls_ctx_t * ctx)
333{
Florin Coras58d36f02018-03-09 13:05:53 -0800334 return tls_vfts[ctx->tls_ctx_engine].ctx_init_client (ctx);
Florin Corasd77eee62018-03-07 08:49:27 -0800335}
336
337static inline int
Florin Coras9f86d222020-03-23 15:34:22 +0000338tls_ctx_write (tls_ctx_t * ctx, session_t * app_session,
339 transport_send_params_t * sp)
Florin Corasd77eee62018-03-07 08:49:27 -0800340{
Florin Coras9f86d222020-03-23 15:34:22 +0000341 u32 n_wrote;
Florin Corased8db522020-02-27 04:32:51 +0000342
Florin Coras9f86d222020-03-23 15:34:22 +0000343 sp->max_burst_size = sp->max_burst_size * TRANSPORT_PACER_MIN_MSS;
344 n_wrote = tls_vfts[ctx->tls_ctx_engine].ctx_write (ctx, app_session, sp);
Florin Coras3e157102022-02-04 13:31:25 -0800345 sp->bytes_dequeued = n_wrote;
Florin Corased8db522020-02-27 04:32:51 +0000346 return n_wrote > 0 ? clib_max (n_wrote / TRANSPORT_PACER_MIN_MSS, 1) : 0;
Florin Corasd77eee62018-03-07 08:49:27 -0800347}
348
349static inline int
Florin Coras288eaab2019-02-03 15:26:14 -0800350tls_ctx_read (tls_ctx_t * ctx, session_t * tls_session)
Florin Corasd77eee62018-03-07 08:49:27 -0800351{
Florin Coras58d36f02018-03-09 13:05:53 -0800352 return tls_vfts[ctx->tls_ctx_engine].ctx_read (ctx, tls_session);
Florin Corasd77eee62018-03-07 08:49:27 -0800353}
354
Florin Coras06a6a302019-04-17 14:19:12 -0700355static inline int
356tls_ctx_transport_close (tls_ctx_t * ctx)
357{
358 return tls_vfts[ctx->tls_ctx_engine].ctx_transport_close (ctx);
359}
360
361static inline int
362tls_ctx_app_close (tls_ctx_t * ctx)
363{
364 return tls_vfts[ctx->tls_ctx_engine].ctx_app_close (ctx);
365}
366
367void
368tls_ctx_free (tls_ctx_t * ctx)
369{
Florin Coras06a6a302019-04-17 14:19:12 -0700370 tls_vfts[ctx->tls_ctx_engine].ctx_free (ctx);
371}
372
373u8
Florin Corasd77eee62018-03-07 08:49:27 -0800374tls_ctx_handshake_is_over (tls_ctx_t * ctx)
375{
Florin Coras58d36f02018-03-09 13:05:53 -0800376 return tls_vfts[ctx->tls_ctx_engine].ctx_handshake_is_over (ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800377}
378
Saravanan Murugesand918cc52022-02-28 19:54:11 +0530379int
380tls_reinit_ca_chain (crypto_engine_type_t tls_engine_id)
381{
382 return tls_vfts[tls_engine_id].ctx_reinit_cachain ();
383}
384
Florin Coras371ca502018-02-21 12:07:41 -0800385void
Florin Coras8c5e5f62022-02-24 16:35:26 -0800386tls_notify_app_io_error (tls_ctx_t *ctx)
387{
388 ASSERT (tls_ctx_handshake_is_over (ctx));
389
390 session_transport_reset_notify (&ctx->connection);
391 session_transport_closed_notify (&ctx->connection);
392 tls_disconnect_transport (ctx);
393}
394
395void
Florin Coras288eaab2019-02-03 15:26:14 -0800396tls_session_reset_callback (session_t * s)
Florin Coras371ca502018-02-21 12:07:41 -0800397{
Florin Corasf03c4942019-08-07 21:39:27 -0700398 tls_ctx_t *ctx;
Zeyu Zhangcbbc4a22019-10-12 14:21:59 +0800399 transport_connection_t *tc;
400 session_t *app_session;
Florin Corasf03c4942019-08-07 21:39:27 -0700401
402 ctx = tls_ctx_get (s->opaque);
Yu Ping83782612020-02-19 02:31:22 +0800403 ctx->is_passive_close = 1;
Zeyu Zhangcbbc4a22019-10-12 14:21:59 +0800404 tc = &ctx->connection;
405 if (tls_ctx_handshake_is_over (ctx))
406 {
407 session_transport_reset_notify (tc);
408 session_transport_closed_notify (tc);
Yu Ping83782612020-02-19 02:31:22 +0800409 tls_disconnect_transport (ctx);
Zeyu Zhangcbbc4a22019-10-12 14:21:59 +0800410 }
Yu Ping83782612020-02-19 02:31:22 +0800411 else
412 if ((app_session =
413 session_get_if_valid (ctx->c_s_index, ctx->c_thread_index)))
414 {
415 session_free (app_session);
416 ctx->c_s_index = SESSION_INVALID_INDEX;
417 tls_disconnect_transport (ctx);
418 }
Florin Coras371ca502018-02-21 12:07:41 -0800419}
420
Florin Coras2c876f92021-05-10 21:12:27 -0700421static void
422tls_session_cleanup_ho (session_t *s)
423{
424 tls_ctx_t *ctx;
425 u32 ho_index;
426
427 /* session opaque stores the opaque passed on connect */
428 ho_index = s->opaque;
429 ctx = tls_ctx_half_open_get (ho_index);
430 session_half_open_delete_notify (&ctx->connection);
Florin Coras2c876f92021-05-10 21:12:27 -0700431 tls_ctx_half_open_free (ho_index);
432}
433
Florin Coras371ca502018-02-21 12:07:41 -0800434int
Florin Corasfa76a762018-11-29 12:40:10 -0800435tls_add_segment_callback (u32 client_index, u64 segment_handle)
Florin Coras371ca502018-02-21 12:07:41 -0800436{
437 /* No-op for builtin */
438 return 0;
439}
440
441int
Florin Corasfa76a762018-11-29 12:40:10 -0800442tls_del_segment_callback (u32 client_index, u64 segment_handle)
Florin Coras371ca502018-02-21 12:07:41 -0800443{
444 return 0;
445}
446
447void
Florin Coras288eaab2019-02-03 15:26:14 -0800448tls_session_disconnect_callback (session_t * tls_session)
Florin Coras371ca502018-02-21 12:07:41 -0800449{
Florin Coras371ca502018-02-21 12:07:41 -0800450 tls_ctx_t *ctx;
Florin Corasbf7ce2c2019-03-06 14:44:42 -0800451
452 TLS_DBG (1, "TCP disconnecting handle %x session %u", tls_session->opaque,
453 tls_session->session_index);
Florin Coras371ca502018-02-21 12:07:41 -0800454
Florin Coras6faac162019-10-11 08:00:43 -0700455 ASSERT (tls_session->thread_index == vlib_get_thread_index ()
456 || vlib_thread_is_main_w_barrier ());
457
458 ctx = tls_ctx_get_w_thread (tls_session->opaque, tls_session->thread_index);
Florin Coras371ca502018-02-21 12:07:41 -0800459 ctx->is_passive_close = 1;
Florin Coras06a6a302019-04-17 14:19:12 -0700460 tls_ctx_transport_close (ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800461}
462
463int
Florin Coras288eaab2019-02-03 15:26:14 -0800464tls_session_accept_callback (session_t * tls_session)
Florin Coras371ca502018-02-21 12:07:41 -0800465{
Florin Coras288eaab2019-02-03 15:26:14 -0800466 session_t *tls_listener, *app_session;
Florin Coras371ca502018-02-21 12:07:41 -0800467 tls_ctx_t *lctx, *ctx;
Florin Coras58d36f02018-03-09 13:05:53 -0800468 u32 ctx_handle;
Xiaoming Jiang47781642023-05-26 00:32:25 +0000469 int rv;
Florin Coras371ca502018-02-21 12:07:41 -0800470
Nathan Skrzypczak2f0f96b2019-06-13 10:14:28 +0200471 tls_listener =
472 listen_session_get_from_handle (tls_session->listener_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800473 lctx = tls_listener_ctx_get (tls_listener->opaque);
Florin Coras58d36f02018-03-09 13:05:53 -0800474
475 ctx_handle = tls_ctx_alloc (lctx->tls_ctx_engine);
476 ctx = tls_ctx_get (ctx_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800477 memcpy (ctx, lctx, sizeof (*lctx));
478 ctx->c_thread_index = vlib_get_thread_index ();
Florin Coras58d36f02018-03-09 13:05:53 -0800479 ctx->tls_ctx_handle = ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800480 tls_session->session_state = SESSION_STATE_READY;
Florin Coras58d36f02018-03-09 13:05:53 -0800481 tls_session->opaque = ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800482 ctx->tls_session_handle = session_handle (tls_session);
483 ctx->listener_ctx_index = tls_listener->opaque;
Florin Corasd09236d2019-08-08 17:38:26 -0700484 ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
Nathan Skrzypczak79f89532019-09-13 11:08:13 +0200485 ctx->ckpair_index = lctx->ckpair_index;
Florin Coras371ca502018-02-21 12:07:41 -0800486
Florin Coras58a93e82019-01-14 23:33:46 -0800487 /* Preallocate app session. Avoids allocating a session post handshake
488 * on tls_session rx and potentially invalidating the session pool */
489 app_session = session_alloc (ctx->c_thread_index);
Srikanth Akulae140d5d2019-11-18 11:49:58 -0800490 app_session->session_state = SESSION_STATE_CREATED;
Florin Corasa127d3c2023-09-25 19:50:48 -0700491 app_session->session_type =
492 session_type_from_proto_and_ip (TRANSPORT_PROTO_TLS, ctx->tcp_is_ip4);
493 app_session->connection_index = ctx->tls_ctx_handle;
Florin Coras58a93e82019-01-14 23:33:46 -0800494 ctx->c_s_index = app_session->session_index;
495
Florin Coras58d36f02018-03-09 13:05:53 -0800496 TLS_DBG (1, "Accept on listener %u new connection [%u]%x",
497 tls_listener->opaque, vlib_get_thread_index (), ctx_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800498
Xiaoming Jiang47781642023-05-26 00:32:25 +0000499 rv = tls_ctx_init_server (ctx);
500 if (rv)
501 {
502 session_free (app_session);
503 tls_ctx_free (ctx);
504 }
505
506 return rv;
Florin Coras371ca502018-02-21 12:07:41 -0800507}
508
509int
Florin Coras288eaab2019-02-03 15:26:14 -0800510tls_app_rx_callback (session_t * tls_session)
Florin Coras371ca502018-02-21 12:07:41 -0800511{
Florin Coras371ca502018-02-21 12:07:41 -0800512 tls_ctx_t *ctx;
Florin Coras371ca502018-02-21 12:07:41 -0800513
Florin Coras4b47ee22020-11-19 13:38:26 -0800514 /* DTLS session migrating, wait for next notification */
515 if (PREDICT_FALSE (tls_session->flags & SESSION_F_IS_MIGRATING))
516 return 0;
517
Florin Coras371ca502018-02-21 12:07:41 -0800518 ctx = tls_ctx_get (tls_session->opaque);
Florin Coras3843d0d2023-10-06 17:31:32 -0700519 if (PREDICT_FALSE (ctx->no_app_session || ctx->app_closed))
Saravanan Murugesan3683d1b2022-02-28 10:55:26 +0530520 {
521 TLS_DBG (1, "Local App closed");
522 return 0;
523 }
Florin Coras58d36f02018-03-09 13:05:53 -0800524 tls_ctx_read (ctx, tls_session);
525 return 0;
Florin Coras371ca502018-02-21 12:07:41 -0800526}
527
528int
Florin Coras9f86d222020-03-23 15:34:22 +0000529tls_app_tx_callback (session_t * tls_session)
530{
531 tls_ctx_t *ctx;
532
533 ctx = tls_ctx_get (tls_session->opaque);
534 transport_connection_reschedule (&ctx->connection);
535
536 return 0;
537}
538
539int
Florin Coras4b47ee22020-11-19 13:38:26 -0800540tls_session_connected_cb (u32 tls_app_index, u32 ho_ctx_index,
541 session_t *tls_session, session_error_t err)
Florin Coras371ca502018-02-21 12:07:41 -0800542{
Florin Coras288eaab2019-02-03 15:26:14 -0800543 session_t *app_session;
Florin Coras371ca502018-02-21 12:07:41 -0800544 tls_ctx_t *ho_ctx, *ctx;
Florin Coras4b47ee22020-11-19 13:38:26 -0800545 session_type_t st;
Florin Coras58d36f02018-03-09 13:05:53 -0800546 u32 ctx_handle;
Xiaoming Jiang47781642023-05-26 00:32:25 +0000547 int rv;
Florin Coras371ca502018-02-21 12:07:41 -0800548
549 ho_ctx = tls_ctx_half_open_get (ho_ctx_index);
Florin Coras371ca502018-02-21 12:07:41 -0800550
Florin Coras58d36f02018-03-09 13:05:53 -0800551 ctx_handle = tls_ctx_alloc (ho_ctx->tls_ctx_engine);
552 ctx = tls_ctx_get (ctx_handle);
Dave Barach178cf492018-11-13 16:34:13 -0500553 clib_memcpy_fast (ctx, ho_ctx, sizeof (*ctx));
Florin Coras2c876f92021-05-10 21:12:27 -0700554 /* Half-open freed on tcp half-open cleanup notification */
Florin Coras371ca502018-02-21 12:07:41 -0800555
Florin Corasdcde9272018-03-02 09:23:42 -0800556 ctx->c_thread_index = vlib_get_thread_index ();
Florin Coras58d36f02018-03-09 13:05:53 -0800557 ctx->tls_ctx_handle = ctx_handle;
Florin Corasd09236d2019-08-08 17:38:26 -0700558 ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
Florin Corasdcde9272018-03-02 09:23:42 -0800559
Florin Coras58d36f02018-03-09 13:05:53 -0800560 TLS_DBG (1, "TCP connect for %u returned %u. New connection [%u]%x",
Florin Coras4b47ee22020-11-19 13:38:26 -0800561 ho_ctx_index, err, vlib_get_thread_index (),
Florin Coras58d36f02018-03-09 13:05:53 -0800562 (ctx) ? ctx_handle : ~0);
Florin Coras371ca502018-02-21 12:07:41 -0800563
564 ctx->tls_session_handle = session_handle (tls_session);
Florin Coras58d36f02018-03-09 13:05:53 -0800565 tls_session->opaque = ctx_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800566 tls_session->session_state = SESSION_STATE_READY;
567
Florin Coras58a93e82019-01-14 23:33:46 -0800568 /* Preallocate app session. Avoids allocating a session post handshake
569 * on tls_session rx and potentially invalidating the session pool */
570 app_session = session_alloc (ctx->c_thread_index);
Srikanth Akulae140d5d2019-11-18 11:49:58 -0800571 app_session->session_state = SESSION_STATE_CREATED;
Florin Coras58a93e82019-01-14 23:33:46 -0800572 ctx->c_s_index = app_session->session_index;
Florin Coras4b47ee22020-11-19 13:38:26 -0800573 st = session_type_from_proto_and_ip (TRANSPORT_PROTO_TLS, ctx->tcp_is_ip4);
574 app_session->session_type = st;
575 app_session->connection_index = ctx->tls_ctx_handle;
Florin Coras58a93e82019-01-14 23:33:46 -0800576
Xiaoming Jiang47781642023-05-26 00:32:25 +0000577 rv = tls_ctx_init_client (ctx);
578 if (rv)
579 {
580 session_free (app_session);
581 tls_ctx_free (ctx);
582 }
583
584 return rv;
Florin Coras371ca502018-02-21 12:07:41 -0800585}
586
Florin Coras4b47ee22020-11-19 13:38:26 -0800587int
588dtls_session_connected_cb (u32 app_wrk_index, u32 ctx_handle, session_t *us,
589 session_error_t err)
590{
591 tls_ctx_t *ctx;
592
Florin Corasfb50bc32021-05-18 00:28:59 -0700593 ctx = tls_ctx_get_w_thread (ctx_handle, transport_cl_thread ());
Florin Coras4b47ee22020-11-19 13:38:26 -0800594
595 ctx->tls_session_handle = session_handle (us);
596 ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
597 us->opaque = ctx_handle;
598
599 /* We don't preallocate the app session because the udp session might
600 * actually migrate to a different worker at the end of the handshake */
601
602 return tls_ctx_init_client (ctx);
603}
604
605int
606tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index,
607 session_t *tls_session, session_error_t err)
608{
Florin Coras71ee3752021-05-28 18:29:08 -0700609 if (err)
610 {
611 app_worker_t *app_wrk;
612 tls_ctx_t *ho_ctx;
613 u32 api_context;
614
615 ho_ctx = tls_ctx_half_open_get (ho_ctx_index);
616 app_wrk = app_worker_get_if_valid (ho_ctx->parent_app_wrk_index);
617 if (app_wrk)
618 {
619 api_context = ho_ctx->parent_app_api_context;
620 app_worker_connect_notify (app_wrk, 0, err, api_context);
621 }
Florin Coras71ee3752021-05-28 18:29:08 -0700622
623 return 0;
624 }
625
Florin Coras4b47ee22020-11-19 13:38:26 -0800626 if (session_get_transport_proto (tls_session) == TRANSPORT_PROTO_TCP)
627 return tls_session_connected_cb (tls_app_index, ho_ctx_index, tls_session,
628 err);
629 else
630 return dtls_session_connected_cb (tls_app_index, ho_ctx_index, tls_session,
631 err);
632}
633
Florin Corasef2b3352019-08-07 11:14:56 -0700634static void
635tls_app_session_cleanup (session_t * s, session_cleanup_ntf_t ntf)
636{
637 tls_ctx_t *ctx;
638
639 if (ntf == SESSION_CLEANUP_TRANSPORT)
Florin Coras36d49392020-04-24 23:00:11 +0000640 {
641 /* Allow cleanup of tcp session */
642 if (s->session_state == SESSION_STATE_TRANSPORT_DELETED)
643 session_close (s);
644 return;
645 }
Florin Corasef2b3352019-08-07 11:14:56 -0700646
647 ctx = tls_ctx_get (s->opaque);
648 if (!ctx->no_app_session)
649 session_transport_delete_notify (&ctx->connection);
650 tls_ctx_free (ctx);
651}
652
Florin Coras4b47ee22020-11-19 13:38:26 -0800653static void
Florin Coras88dd3cf2021-05-01 19:01:42 -0700654dtls_migrate_ctx (void *arg)
Florin Coras4b47ee22020-11-19 13:38:26 -0800655{
656 tls_ctx_t *ctx = (tls_ctx_t *) arg;
657 u32 ctx_handle, thread_index;
658 session_t *us;
659
660 thread_index = session_thread_from_handle (ctx->tls_session_handle);
661 ASSERT (thread_index == vlib_get_thread_index ());
662
663 ctx_handle = tls_ctx_attach (ctx->tls_ctx_engine, thread_index, ctx);
664 ctx = tls_ctx_get_w_thread (ctx_handle, thread_index);
665 ctx->tls_ctx_handle = ctx_handle;
666
667 us = session_get_from_handle (ctx->tls_session_handle);
668 us->opaque = ctx_handle;
669 us->flags &= ~SESSION_F_IS_MIGRATING;
Florin Corasbab6c522021-05-13 08:36:56 -0700670
671 /* Probably the app detached while the session was migrating. Cleanup */
672 if (session_half_open_migrated_notify (&ctx->connection))
673 {
674 ctx->no_app_session = 1;
675 tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
676 return;
677 }
678
Florin Coras4b47ee22020-11-19 13:38:26 -0800679 if (svm_fifo_max_dequeue (us->tx_fifo))
680 session_send_io_evt_to_thread (us->tx_fifo, SESSION_IO_EVT_TX);
681}
682
683static void
684dtls_session_migrate_callback (session_t *us, session_handle_t new_sh)
685{
686 u32 new_thread = session_thread_from_handle (new_sh);
Florin Coras88dd3cf2021-05-01 19:01:42 -0700687 tls_ctx_t *ctx, *cloned_ctx;
Florin Coras4b47ee22020-11-19 13:38:26 -0800688
689 /* Migrate dtls context to new thread */
690 ctx = tls_ctx_get_w_thread (us->opaque, us->thread_index);
691 ctx->tls_session_handle = new_sh;
Florin Coras88dd3cf2021-05-01 19:01:42 -0700692 cloned_ctx = tls_ctx_detach (ctx);
Florin Coras4b47ee22020-11-19 13:38:26 -0800693 ctx->is_migrated = 1;
Florin Corasbab6c522021-05-13 08:36:56 -0700694 session_half_open_migrate_notify (&ctx->connection);
Florin Coras4b47ee22020-11-19 13:38:26 -0800695
Florin Coras88dd3cf2021-05-01 19:01:42 -0700696 session_send_rpc_evt_to_thread (new_thread, dtls_migrate_ctx,
697 (void *) cloned_ctx);
698
699 tls_ctx_free (ctx);
Florin Coras4b47ee22020-11-19 13:38:26 -0800700}
701
Florin Coras371ca502018-02-21 12:07:41 -0800702static session_cb_vft_t tls_app_cb_vft = {
703 .session_accept_callback = tls_session_accept_callback,
704 .session_disconnect_callback = tls_session_disconnect_callback,
705 .session_connected_callback = tls_session_connected_callback,
706 .session_reset_callback = tls_session_reset_callback,
Florin Coras2c876f92021-05-10 21:12:27 -0700707 .half_open_cleanup_callback = tls_session_cleanup_ho,
Florin Coras371ca502018-02-21 12:07:41 -0800708 .add_segment_callback = tls_add_segment_callback,
709 .del_segment_callback = tls_del_segment_callback,
710 .builtin_app_rx_callback = tls_app_rx_callback,
Florin Coras9f86d222020-03-23 15:34:22 +0000711 .builtin_app_tx_callback = tls_app_tx_callback,
Florin Coras4b47ee22020-11-19 13:38:26 -0800712 .session_migrate_callback = dtls_session_migrate_callback,
Florin Corasef2b3352019-08-07 11:14:56 -0700713 .session_cleanup_callback = tls_app_session_cleanup,
Florin Coras371ca502018-02-21 12:07:41 -0800714};
Florin Coras371ca502018-02-21 12:07:41 -0800715
716int
Florin Coras5665ced2018-10-25 18:03:45 -0700717tls_connect (transport_endpoint_cfg_t * tep)
Florin Coras371ca502018-02-21 12:07:41 -0800718{
Florin Coras15531972018-08-12 23:50:53 -0700719 vnet_connect_args_t _cargs = { {}, }, *cargs = &_cargs;
Florin Corasa54b62d2021-04-21 09:05:56 -0700720 transport_endpt_crypto_cfg_t *ccfg;
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200721 crypto_engine_type_t engine_type;
Florin Coras4b47ee22020-11-19 13:38:26 -0800722 session_endpoint_cfg_t *sep;
Florin Coras371ca502018-02-21 12:07:41 -0800723 tls_main_t *tm = &tls_main;
Florin Coras15531972018-08-12 23:50:53 -0700724 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800725 application_t *app;
726 tls_ctx_t *ctx;
727 u32 ctx_index;
Florin Corasc1a42652019-02-08 18:27:29 -0800728 int rv;
Florin Coras371ca502018-02-21 12:07:41 -0800729
Florin Coras5665ced2018-10-25 18:03:45 -0700730 sep = (session_endpoint_cfg_t *) tep;
Florin Corasa54b62d2021-04-21 09:05:56 -0700731 if (!sep->ext_cfg)
Florin Corase5f18332021-04-22 11:48:35 -0700732 return SESSION_E_NOEXTCFG;
Florin Corasa54b62d2021-04-21 09:05:56 -0700733
Florin Coras15531972018-08-12 23:50:53 -0700734 app_wrk = app_worker_get (sep->app_wrk_index);
735 app = application_get (app_wrk->app_index);
Florin Corasa54b62d2021-04-21 09:05:56 -0700736
737 ccfg = &sep->ext_cfg->crypto;
738 engine_type = tls_get_engine_type (ccfg->crypto_engine, app->tls_engine);
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200739 if (engine_type == CRYPTO_ENGINE_NONE)
Florin Coras58d36f02018-03-09 13:05:53 -0800740 {
741 clib_warning ("No tls engine_type available");
Florin Corase5f18332021-04-22 11:48:35 -0700742 return SESSION_E_NOCRYPTOENG;
Florin Coras58d36f02018-03-09 13:05:53 -0800743 }
Florin Coras371ca502018-02-21 12:07:41 -0800744
745 ctx_index = tls_ctx_half_open_alloc ();
746 ctx = tls_ctx_half_open_get (ctx_index);
Florin Corasdf57ea02019-02-18 20:14:20 -0800747 ctx->parent_app_wrk_index = sep->app_wrk_index;
Florin Coras371ca502018-02-21 12:07:41 -0800748 ctx->parent_app_api_context = sep->opaque;
749 ctx->tcp_is_ip4 = sep->is_ip4;
Florin Coras4b47ee22020-11-19 13:38:26 -0800750 ctx->tls_type = sep->transport_proto;
Florin Corasa54b62d2021-04-21 09:05:56 -0700751 ctx->ckpair_index = ccfg->ckpair_index;
Florin Coras2c876f92021-05-10 21:12:27 -0700752 ctx->c_proto = TRANSPORT_PROTO_TLS;
753 ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
Florin Corasa54b62d2021-04-21 09:05:56 -0700754 if (ccfg->hostname[0])
Florin Coras8f89dd02018-03-05 16:53:07 -0800755 {
Florin Corasa54b62d2021-04-21 09:05:56 -0700756 ctx->srv_hostname = format (0, "%s", ccfg->hostname);
Florin Coras8f89dd02018-03-05 16:53:07 -0800757 vec_terminate_c_string (ctx->srv_hostname);
758 }
Florin Coras371ca502018-02-21 12:07:41 -0800759
Florin Coras58d36f02018-03-09 13:05:53 -0800760 ctx->tls_ctx_engine = engine_type;
Florin Coras371ca502018-02-21 12:07:41 -0800761
Dave Barach178cf492018-11-13 16:34:13 -0500762 clib_memcpy_fast (&cargs->sep, sep, sizeof (session_endpoint_t));
Florin Coras15531972018-08-12 23:50:53 -0700763 cargs->sep.transport_proto = TRANSPORT_PROTO_TCP;
764 cargs->app_index = tm->app_index;
765 cargs->api_context = ctx_index;
Florin Coras8a140612019-02-18 22:39:39 -0800766 cargs->sep_ext.ns_index = app->ns_index;
Florin Corasc1a42652019-02-08 18:27:29 -0800767 if ((rv = vnet_connect (cargs)))
768 return rv;
Florin Coras371ca502018-02-21 12:07:41 -0800769
Florin Coras2c876f92021-05-10 21:12:27 -0700770 /* Track half-open tcp session in case we need to clean it up */
771 ctx->tls_session_handle = cargs->sh;
772
Florin Coras58d36f02018-03-09 13:05:53 -0800773 TLS_DBG (1, "New connect request %u engine %d", ctx_index, engine_type);
Florin Coras2c876f92021-05-10 21:12:27 -0700774 return ctx_index;
Florin Coras371ca502018-02-21 12:07:41 -0800775}
776
777void
Florin Coras58d36f02018-03-09 13:05:53 -0800778tls_disconnect (u32 ctx_handle, u32 thread_index)
Florin Coras371ca502018-02-21 12:07:41 -0800779{
Florin Coras371ca502018-02-21 12:07:41 -0800780 tls_ctx_t *ctx;
781
Florin Coras58d36f02018-03-09 13:05:53 -0800782 TLS_DBG (1, "Disconnecting %x", ctx_handle);
Florin Coras371ca502018-02-21 12:07:41 -0800783
Florin Coras58d36f02018-03-09 13:05:53 -0800784 ctx = tls_ctx_get (ctx_handle);
Florin Coras06a6a302019-04-17 14:19:12 -0700785 tls_ctx_app_close (ctx);
Florin Coras371ca502018-02-21 12:07:41 -0800786}
787
788u32
Florin Coras0bce71e2022-02-10 11:57:06 -0800789tls_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep)
Florin Coras371ca502018-02-21 12:07:41 -0800790{
Florin Corasc9940fc2019-02-05 20:55:11 -0800791 vnet_listen_args_t _bargs, *args = &_bargs;
Florin Corasa54b62d2021-04-21 09:05:56 -0700792 transport_endpt_crypto_cfg_t *ccfg;
Florin Corasab2f6db2018-08-31 14:31:41 -0700793 app_worker_t *app_wrk;
Florin Coras371ca502018-02-21 12:07:41 -0800794 tls_main_t *tm = &tls_main;
Florin Corasa27a46e2019-02-18 13:02:28 -0800795 session_handle_t tls_al_handle;
Florin Coras5665ced2018-10-25 18:03:45 -0700796 session_endpoint_cfg_t *sep;
Florin Coras288eaab2019-02-03 15:26:14 -0800797 session_t *tls_listener;
798 session_t *app_listener;
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200799 crypto_engine_type_t engine_type;
Florin Coras74cac882018-09-07 09:13:15 -0700800 application_t *app;
Florin Corasa27a46e2019-02-18 13:02:28 -0800801 app_listener_t *al;
Florin Coras15531972018-08-12 23:50:53 -0700802 tls_ctx_t *lctx;
803 u32 lctx_index;
Florin Corase5f18332021-04-22 11:48:35 -0700804 int rv;
Florin Coras371ca502018-02-21 12:07:41 -0800805
Florin Coras5665ced2018-10-25 18:03:45 -0700806 sep = (session_endpoint_cfg_t *) tep;
Florin Corasa54b62d2021-04-21 09:05:56 -0700807 if (!sep->ext_cfg)
Florin Corase5f18332021-04-22 11:48:35 -0700808 return SESSION_E_NOEXTCFG;
Florin Corasa54b62d2021-04-21 09:05:56 -0700809
Florin Coras15531972018-08-12 23:50:53 -0700810 app_wrk = app_worker_get (sep->app_wrk_index);
811 app = application_get (app_wrk->app_index);
Florin Corasa54b62d2021-04-21 09:05:56 -0700812
813 ccfg = &sep->ext_cfg->crypto;
814 engine_type = tls_get_engine_type (ccfg->crypto_engine, app->tls_engine);
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200815 if (engine_type == CRYPTO_ENGINE_NONE)
Florin Coras58d36f02018-03-09 13:05:53 -0800816 {
817 clib_warning ("No tls engine_type available");
Florin Corase5f18332021-04-22 11:48:35 -0700818 return SESSION_E_NOCRYPTOENG;
Florin Coras58d36f02018-03-09 13:05:53 -0800819 }
820
Dave Barachb7b92992018-10-17 10:38:51 -0400821 clib_memset (args, 0, sizeof (*args));
Florin Coras74cac882018-09-07 09:13:15 -0700822 args->app_index = tm->app_index;
823 args->sep_ext = *sep;
Florin Coras8a140612019-02-18 22:39:39 -0800824 args->sep_ext.ns_index = app->ns_index;
Florin Coras95cd8642019-12-30 21:53:19 -0800825 args->sep_ext.transport_proto = TRANSPORT_PROTO_TCP;
Florin Coras4b47ee22020-11-19 13:38:26 -0800826 if (sep->transport_proto == TRANSPORT_PROTO_DTLS)
827 {
828 args->sep_ext.transport_proto = TRANSPORT_PROTO_UDP;
829 args->sep_ext.transport_flags = TRANSPORT_CFG_F_CONNECTED;
830 }
Florin Corase5f18332021-04-22 11:48:35 -0700831 if ((rv = vnet_listen (args)))
832 return rv;
Florin Coras371ca502018-02-21 12:07:41 -0800833
Florin Coras74cac882018-09-07 09:13:15 -0700834 lctx_index = tls_listener_ctx_alloc ();
Florin Corasa27a46e2019-02-18 13:02:28 -0800835 tls_al_handle = args->handle;
836 al = app_listener_get_w_handle (tls_al_handle);
837 tls_listener = app_listener_get_session (al);
Florin Coras371ca502018-02-21 12:07:41 -0800838 tls_listener->opaque = lctx_index;
Florin Coras58d36f02018-03-09 13:05:53 -0800839
Florin Coras5c9083d2018-04-13 06:39:07 -0700840 app_listener = listen_session_get (app_listener_index);
Florin Coras58d36f02018-03-09 13:05:53 -0800841
842 lctx = tls_listener_ctx_get (lctx_index);
Florin Corasdf57ea02019-02-18 20:14:20 -0800843 lctx->parent_app_wrk_index = sep->app_wrk_index;
Florin Corasa27a46e2019-02-18 13:02:28 -0800844 lctx->tls_session_handle = tls_al_handle;
Florin Coras371ca502018-02-21 12:07:41 -0800845 lctx->app_session_handle = listen_session_get_handle (app_listener);
846 lctx->tcp_is_ip4 = sep->is_ip4;
Florin Coras58d36f02018-03-09 13:05:53 -0800847 lctx->tls_ctx_engine = engine_type;
Florin Coras4b47ee22020-11-19 13:38:26 -0800848 lctx->tls_type = sep->transport_proto;
Florin Corasa54b62d2021-04-21 09:05:56 -0700849 lctx->ckpair_index = ccfg->ckpair_index;
Florin Coras7705b492022-02-16 17:12:01 -0800850 lctx->c_s_index = app_listener_index;
Filip Tehlar61e26be2021-12-20 14:40:59 +0000851 lctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
Florin Coras58d36f02018-03-09 13:05:53 -0800852
Florin Corasae3eaac2019-07-23 22:38:16 -0700853 if (tls_vfts[engine_type].ctx_start_listen (lctx))
854 {
855 vnet_unlisten_args_t a = {
856 .handle = lctx->tls_session_handle,
857 .app_index = tls_main.app_index,
858 .wrk_map_index = 0
859 };
860 if ((vnet_unlisten (&a)))
861 clib_warning ("unlisten returned");
862 tls_listener_ctx_free (lctx);
863 lctx_index = SESSION_INVALID_INDEX;
864 }
Ping Yudecda5b2018-08-13 06:20:00 -0400865
Florin Coras58d36f02018-03-09 13:05:53 -0800866 TLS_DBG (1, "Started listening %d, engine type %d", lctx_index,
867 engine_type);
Florin Coras371ca502018-02-21 12:07:41 -0800868 return lctx_index;
869}
870
871u32
Florin Corase3e2f072018-03-04 07:24:30 -0800872tls_stop_listen (u32 lctx_index)
Florin Coras371ca502018-02-21 12:07:41 -0800873{
Florin Corasaab06042020-02-26 02:56:14 +0000874 session_endpoint_t sep = SESSION_ENDPOINT_NULL;
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +0200875 crypto_engine_type_t engine_type;
Florin Corasaab06042020-02-26 02:56:14 +0000876 transport_connection_t *lc;
Florin Corasb5e94e32018-09-14 14:46:39 -0700877 tls_ctx_t *lctx;
Florin Corasaab06042020-02-26 02:56:14 +0000878 session_t *ls;
Florin Corasc1a42652019-02-08 18:27:29 -0800879 int rv;
Ping Yudecda5b2018-08-13 06:20:00 -0400880
Florin Corase3e2f072018-03-04 07:24:30 -0800881 lctx = tls_listener_ctx_get (lctx_index);
Florin Corasaab06042020-02-26 02:56:14 +0000882
883 /* Cleanup listener from session lookup table */
884 ls = session_get_from_handle (lctx->tls_session_handle);
885 lc = session_get_transport (ls);
886
887 sep.fib_index = lc->fib_index;
888 sep.port = lc->lcl_port;
889 sep.is_ip4 = lc->is_ip4;
Florin Coras4b47ee22020-11-19 13:38:26 -0800890 sep.transport_proto = lctx->tls_type;
Florin Corasaab06042020-02-26 02:56:14 +0000891 clib_memcpy (&sep.ip, &lc->lcl_ip, sizeof (lc->lcl_ip));
892 session_lookup_del_session_endpoint2 (&sep);
893
Florin Corasc1a42652019-02-08 18:27:29 -0800894 vnet_unlisten_args_t a = {
Florin Corasb5e94e32018-09-14 14:46:39 -0700895 .handle = lctx->tls_session_handle,
896 .app_index = tls_main.app_index,
897 .wrk_map_index = 0 /* default wrk */
898 };
Florin Corasc1a42652019-02-08 18:27:29 -0800899 if ((rv = vnet_unlisten (&a)))
900 clib_warning ("unlisten returned %d", rv);
Florin Corasb5e94e32018-09-14 14:46:39 -0700901
Ping Yudecda5b2018-08-13 06:20:00 -0400902 engine_type = lctx->tls_ctx_engine;
903 tls_vfts[engine_type].ctx_stop_listen (lctx);
904
Florin Corase3e2f072018-03-04 07:24:30 -0800905 tls_listener_ctx_free (lctx);
Florin Coras371ca502018-02-21 12:07:41 -0800906 return 0;
907}
908
909transport_connection_t *
Florin Corase3e2f072018-03-04 07:24:30 -0800910tls_connection_get (u32 ctx_index, u32 thread_index)
911{
912 tls_ctx_t *ctx;
913 ctx = tls_ctx_get_w_thread (ctx_index, thread_index);
914 return &ctx->connection;
915}
916
917transport_connection_t *
Florin Coras371ca502018-02-21 12:07:41 -0800918tls_listener_get (u32 listener_index)
919{
920 tls_ctx_t *ctx;
921 ctx = tls_listener_ctx_get (listener_index);
922 return &ctx->connection;
923}
924
Florin Coras2c876f92021-05-10 21:12:27 -0700925static transport_connection_t *
926tls_half_open_get (u32 ho_index)
927{
Florin Coras2c876f92021-05-10 21:12:27 -0700928 tls_ctx_t *ctx;
929 ctx = tls_ctx_half_open_get (ho_index);
Florin Coras2c876f92021-05-10 21:12:27 -0700930 return &ctx->connection;
931}
932
933static void
934tls_cleanup_ho (u32 ho_index)
935{
Florin Coras2c876f92021-05-10 21:12:27 -0700936 tls_ctx_t *ctx;
Florin Corasbab6c522021-05-13 08:36:56 -0700937
Florin Coras2c876f92021-05-10 21:12:27 -0700938 ctx = tls_ctx_half_open_get (ho_index);
Florin Coras009303d2022-03-29 17:49:37 -0700939 session_cleanup_half_open (ctx->tls_session_handle);
Florin Corasbab6c522021-05-13 08:36:56 -0700940 tls_ctx_half_open_free (ho_index);
Florin Coras2c876f92021-05-10 21:12:27 -0700941}
942
Florin Corasf940f8a2019-03-06 10:44:38 -0800943int
Florin Coras9f86d222020-03-23 15:34:22 +0000944tls_custom_tx_callback (void *session, transport_send_params_t * sp)
Florin Corasf940f8a2019-03-06 10:44:38 -0800945{
Florin Coras00d7d862023-09-22 19:26:33 -0700946 session_t *as = (session_t *) session;
Florin Corasf940f8a2019-03-06 10:44:38 -0800947 tls_ctx_t *ctx;
Florin Corasbf7ce2c2019-03-06 14:44:42 -0800948
Florin Coras00d7d862023-09-22 19:26:33 -0700949 if (PREDICT_FALSE (as->session_state >= SESSION_STATE_TRANSPORT_CLOSED ||
950 as->session_state <= SESSION_STATE_ACCEPTING))
951 {
952 sp->flags |= TRANSPORT_SND_F_DESCHED;
953 return 0;
954 }
Florin Corasbf7ce2c2019-03-06 14:44:42 -0800955
Florin Coras00d7d862023-09-22 19:26:33 -0700956 ctx = tls_ctx_get (as->connection_index);
957 return tls_ctx_write (ctx, as, sp);
Florin Corasf940f8a2019-03-06 10:44:38 -0800958}
959
Florin Coras371ca502018-02-21 12:07:41 -0800960u8 *
961format_tls_ctx (u8 * s, va_list * args)
962{
jiangxiaoming5b7ea912020-09-23 10:29:21 +0800963 u32 tcp_si, tcp_ti, ctx_index, ctx_engine;
Florin Coras371ca502018-02-21 12:07:41 -0800964 tls_ctx_t *ctx = va_arg (*args, tls_ctx_t *);
Florin Coras4b47ee22020-11-19 13:38:26 -0800965 char *proto;
Florin Coras371ca502018-02-21 12:07:41 -0800966
Florin Coras4b47ee22020-11-19 13:38:26 -0800967 proto = ctx->tls_type == TRANSPORT_PROTO_TLS ? "TLS" : "DTLS";
Florin Corasbf7ce2c2019-03-06 14:44:42 -0800968 session_parse_handle (ctx->tls_session_handle, &tcp_si, &tcp_ti);
969 tls_ctx_parse_handle (ctx->tls_ctx_handle, &ctx_index, &ctx_engine);
Florin Coras4b47ee22020-11-19 13:38:26 -0800970 s =
971 format (s, "[%d:%d][%s] app_wrk %u index %u engine %u ts %d:%d",
972 ctx->c_thread_index, ctx->c_s_index, proto,
973 ctx->parent_app_wrk_index, ctx_index, ctx_engine, tcp_ti, tcp_si);
Florin Coras371ca502018-02-21 12:07:41 -0800974
Florin Coras371ca502018-02-21 12:07:41 -0800975 return s;
976}
977
Florin Coras0d74dd12020-01-07 19:01:26 +0000978static u8 *
979format_tls_listener_ctx (u8 * s, va_list * args)
980{
981 session_t *tls_listener;
982 app_listener_t *al;
Florin Coras0d74dd12020-01-07 19:01:26 +0000983 tls_ctx_t *ctx;
Florin Coras4b47ee22020-11-19 13:38:26 -0800984 char *proto;
Florin Coras0d74dd12020-01-07 19:01:26 +0000985
986 ctx = va_arg (*args, tls_ctx_t *);
987
Florin Coras4b47ee22020-11-19 13:38:26 -0800988 proto = ctx->tls_type == TRANSPORT_PROTO_TLS ? "TLS" : "DTLS";
Florin Coras0d74dd12020-01-07 19:01:26 +0000989 al = app_listener_get_w_handle (ctx->tls_session_handle);
990 tls_listener = app_listener_get_session (al);
Florin Coras4b47ee22020-11-19 13:38:26 -0800991 s = format (s, "[%d:%d][%s] app_wrk %u engine %u ts %d:%d",
992 ctx->c_thread_index, ctx->c_s_index, proto,
jiangxiaoming5b7ea912020-09-23 10:29:21 +0800993 ctx->parent_app_wrk_index, ctx->tls_ctx_engine,
Florin Coras0d74dd12020-01-07 19:01:26 +0000994 tls_listener->thread_index, tls_listener->session_index);
995
996 return s;
997}
998
999static u8 *
1000format_tls_ctx_state (u8 * s, va_list * args)
1001{
1002 tls_ctx_t *ctx;
1003 session_t *ts;
1004
1005 ctx = va_arg (*args, tls_ctx_t *);
jiangxiaoming5b7ea912020-09-23 10:29:21 +08001006 ts = session_get (ctx->c_s_index, ctx->c_thread_index);
Florin Coras0d74dd12020-01-07 19:01:26 +00001007 if (ts->session_state == SESSION_STATE_LISTENING)
1008 s = format (s, "%s", "LISTEN");
Florin Coras0d74dd12020-01-07 19:01:26 +00001009 else
Florin Coras681ea6d2020-04-24 16:59:49 +00001010 {
1011 if (ts->session_state >= SESSION_STATE_TRANSPORT_CLOSED)
1012 s = format (s, "%s", "CLOSED");
1013 else if (ts->session_state == SESSION_STATE_APP_CLOSED)
1014 s = format (s, "%s", "APP-CLOSED");
1015 else if (ts->session_state >= SESSION_STATE_TRANSPORT_CLOSING)
1016 s = format (s, "%s", "CLOSING");
1017 else if (tls_ctx_handshake_is_over (ctx))
1018 s = format (s, "%s", "ESTABLISHED");
1019 else
1020 s = format (s, "%s", "HANDSHAKE");
1021 }
Florin Coras0d74dd12020-01-07 19:01:26 +00001022
1023 return s;
1024}
1025
Florin Coras371ca502018-02-21 12:07:41 -08001026u8 *
1027format_tls_connection (u8 * s, va_list * args)
1028{
1029 u32 ctx_index = va_arg (*args, u32);
1030 u32 thread_index = va_arg (*args, u32);
1031 u32 verbose = va_arg (*args, u32);
1032 tls_ctx_t *ctx;
1033
1034 ctx = tls_ctx_get_w_thread (ctx_index, thread_index);
1035 if (!ctx)
1036 return s;
1037
Florin Coras7bf6ed62020-09-23 12:02:08 -07001038 s = format (s, "%-" SESSION_CLI_ID_LEN "U", format_tls_ctx, ctx);
Florin Coras371ca502018-02-21 12:07:41 -08001039 if (verbose)
1040 {
Florin Coras7bf6ed62020-09-23 12:02:08 -07001041 s = format (s, "%-" SESSION_CLI_STATE_LEN "U", format_tls_ctx_state,
1042 ctx);
Florin Coras371ca502018-02-21 12:07:41 -08001043 if (verbose > 1)
1044 s = format (s, "\n");
1045 }
1046 return s;
1047}
1048
1049u8 *
1050format_tls_listener (u8 * s, va_list * args)
1051{
1052 u32 tc_index = va_arg (*args, u32);
Aloys Augustina0abbff2019-07-12 12:16:16 +02001053 u32 __clib_unused thread_index = va_arg (*args, u32);
Florin Coras0d74dd12020-01-07 19:01:26 +00001054 u32 verbose = va_arg (*args, u32);
Florin Coras371ca502018-02-21 12:07:41 -08001055 tls_ctx_t *ctx = tls_listener_ctx_get (tc_index);
Florin Coras371ca502018-02-21 12:07:41 -08001056
Florin Coras7bf6ed62020-09-23 12:02:08 -07001057 s = format (s, "%-" SESSION_CLI_ID_LEN "U", format_tls_listener_ctx, ctx);
Florin Coras0d74dd12020-01-07 19:01:26 +00001058 if (verbose)
Florin Coras7bf6ed62020-09-23 12:02:08 -07001059 s = format (s, "%-" SESSION_CLI_STATE_LEN "U", format_tls_ctx_state, ctx);
Florin Corasbf7ce2c2019-03-06 14:44:42 -08001060 return s;
Florin Coras371ca502018-02-21 12:07:41 -08001061}
1062
1063u8 *
1064format_tls_half_open (u8 * s, va_list * args)
1065{
Florin Coras2c876f92021-05-10 21:12:27 -07001066 u32 ho_index = va_arg (*args, u32);
Aloys Augustina0abbff2019-07-12 12:16:16 +02001067 u32 __clib_unused thread_index = va_arg (*args, u32);
Florin Corasd69ef3a2023-10-02 10:41:54 -07001068 u32 __clib_unused verbose = va_arg (*args, u32);
Florin Coras2c876f92021-05-10 21:12:27 -07001069 session_t *tcp_ho;
1070 tls_ctx_t *ho_ctx;
1071
1072 ho_ctx = tls_ctx_half_open_get (ho_index);
1073
1074 tcp_ho = session_get_from_handle (ho_ctx->tls_session_handle);
1075 s = format (s, "[%d:%d][%s] half-open app_wrk %u engine %u ts %d:%d",
1076 ho_ctx->c_thread_index, ho_ctx->c_s_index, "TLS",
1077 ho_ctx->parent_app_wrk_index, ho_ctx->tls_ctx_engine,
1078 tcp_ho->thread_index, tcp_ho->session_index);
1079
Florin Coras371ca502018-02-21 12:07:41 -08001080 return s;
1081}
1082
Yu Ping0b819152019-05-07 02:24:30 +08001083static void
1084tls_transport_endpoint_get (u32 ctx_handle, u32 thread_index,
1085 transport_endpoint_t * tep, u8 is_lcl)
1086{
1087 tls_ctx_t *ctx = tls_ctx_get_w_thread (ctx_handle, thread_index);
1088 session_t *tcp_session;
1089
1090 tcp_session = session_get_from_handle (ctx->tls_session_handle);
1091 session_get_endpoint (tcp_session, tep, is_lcl);
1092}
1093
1094static void
1095tls_transport_listener_endpoint_get (u32 ctx_handle,
1096 transport_endpoint_t * tep, u8 is_lcl)
1097{
1098 session_t *tls_listener;
1099 app_listener_t *al;
1100 tls_ctx_t *ctx = tls_listener_ctx_get (ctx_handle);
1101
1102 al = app_listener_get_w_handle (ctx->tls_session_handle);
1103 tls_listener = app_listener_get_session (al);
1104 session_get_endpoint (tls_listener, tep, is_lcl);
1105}
1106
Florin Coras0a9ab822020-10-25 14:01:37 -07001107static clib_error_t *
1108tls_enable (vlib_main_t * vm, u8 is_en)
1109{
Florin Coras0a9ab822020-10-25 14:01:37 -07001110 vnet_app_detach_args_t _da, *da = &_da;
1111 vnet_app_attach_args_t _a, *a = &_a;
1112 u64 options[APP_OPTIONS_N_OPTIONS];
1113 tls_main_t *tm = &tls_main;
Florin Corasc1b03802023-09-30 15:21:08 -07001114 u32 fifo_size = 512 << 10;
Florin Coras0a9ab822020-10-25 14:01:37 -07001115
1116 if (!is_en)
1117 {
1118 da->app_index = tm->app_index;
1119 da->api_client_index = APP_INVALID_INDEX;
1120 vnet_application_detach (da);
1121 return 0;
1122 }
1123
Florin Coras0a9ab822020-10-25 14:01:37 -07001124 fifo_size = tm->fifo_size ? tm->fifo_size : fifo_size;
1125
1126 clib_memset (a, 0, sizeof (*a));
1127 clib_memset (options, 0, sizeof (options));
1128
1129 a->session_cb_vft = &tls_app_cb_vft;
1130 a->api_client_index = APP_INVALID_INDEX;
1131 a->options = options;
1132 a->name = format (0, "tls");
Florin Corasa3767bd2021-11-18 15:25:31 -08001133 a->options[APP_OPTIONS_SEGMENT_SIZE] = tm->first_seg_size;
1134 a->options[APP_OPTIONS_ADD_SEGMENT_SIZE] = tm->add_seg_size;
Florin Coras0a9ab822020-10-25 14:01:37 -07001135 a->options[APP_OPTIONS_RX_FIFO_SIZE] = fifo_size;
1136 a->options[APP_OPTIONS_TX_FIFO_SIZE] = fifo_size;
1137 a->options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
1138 a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
1139 a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_IS_TRANSPORT_APP;
1140
1141 if (vnet_application_attach (a))
1142 {
1143 clib_warning ("failed to attach tls app");
1144 return clib_error_return (0, "failed to attach tls app");
1145 }
1146
1147 tm->app_index = a->app_index;
1148 vec_free (a->name);
1149
1150 return 0;
1151}
1152
Nathan Skrzypczake971bc92019-06-19 13:42:37 +02001153static const transport_proto_vft_t tls_proto = {
Florin Coras0a9ab822020-10-25 14:01:37 -07001154 .enable = tls_enable,
Florin Coras1ee78302019-02-05 15:51:15 -08001155 .connect = tls_connect,
Florin Coras371ca502018-02-21 12:07:41 -08001156 .close = tls_disconnect,
Florin Coras1ee78302019-02-05 15:51:15 -08001157 .start_listen = tls_start_listen,
1158 .stop_listen = tls_stop_listen,
Florin Corase3e2f072018-03-04 07:24:30 -08001159 .get_connection = tls_connection_get,
Florin Coras371ca502018-02-21 12:07:41 -08001160 .get_listener = tls_listener_get,
Florin Coras2c876f92021-05-10 21:12:27 -07001161 .get_half_open = tls_half_open_get,
1162 .cleanup_ho = tls_cleanup_ho,
Florin Corasf940f8a2019-03-06 10:44:38 -08001163 .custom_tx = tls_custom_tx_callback,
Florin Coras371ca502018-02-21 12:07:41 -08001164 .format_connection = format_tls_connection,
1165 .format_half_open = format_tls_half_open,
1166 .format_listener = format_tls_listener,
Yu Ping0b819152019-05-07 02:24:30 +08001167 .get_transport_endpoint = tls_transport_endpoint_get,
1168 .get_transport_listener_endpoint = tls_transport_listener_endpoint_get,
Nathan Skrzypczake971bc92019-06-19 13:42:37 +02001169 .transport_options = {
Florin Coras07063b82020-03-13 04:44:51 +00001170 .name = "tls",
1171 .short_name = "J",
Nathan Skrzypczake971bc92019-06-19 13:42:37 +02001172 .tx_type = TRANSPORT_TX_INTERNAL,
Florin Coras2c876f92021-05-10 21:12:27 -07001173 .service_type = TRANSPORT_SERVICE_VC,
Nathan Skrzypczake971bc92019-06-19 13:42:37 +02001174 },
Florin Coras371ca502018-02-21 12:07:41 -08001175};
Florin Coras4b47ee22020-11-19 13:38:26 -08001176
1177int
1178dtls_connect (transport_endpoint_cfg_t *tep)
1179{
1180 vnet_connect_args_t _cargs = { {}, }, *cargs = &_cargs;
Florin Corasa54b62d2021-04-21 09:05:56 -07001181 transport_endpt_crypto_cfg_t *ccfg;
Florin Coras4b47ee22020-11-19 13:38:26 -08001182 crypto_engine_type_t engine_type;
1183 session_endpoint_cfg_t *sep;
1184 tls_main_t *tm = &tls_main;
1185 app_worker_t *app_wrk;
1186 application_t *app;
1187 tls_ctx_t *ctx;
1188 u32 ctx_handle;
1189 int rv;
1190
1191 sep = (session_endpoint_cfg_t *) tep;
Florin Corasa54b62d2021-04-21 09:05:56 -07001192 if (!sep->ext_cfg)
1193 return -1;
1194
Florin Coras4b47ee22020-11-19 13:38:26 -08001195 app_wrk = app_worker_get (sep->app_wrk_index);
1196 app = application_get (app_wrk->app_index);
Florin Corasa54b62d2021-04-21 09:05:56 -07001197
1198 ccfg = &sep->ext_cfg->crypto;
1199 engine_type = tls_get_engine_type (ccfg->crypto_engine, app->tls_engine);
Florin Coras4b47ee22020-11-19 13:38:26 -08001200 if (engine_type == CRYPTO_ENGINE_NONE)
1201 {
1202 clib_warning ("No tls engine_type available");
1203 return -1;
1204 }
1205
Florin Corasfb50bc32021-05-18 00:28:59 -07001206 ctx_handle = tls_ctx_alloc_w_thread (engine_type, transport_cl_thread ());
1207 ctx = tls_ctx_get_w_thread (ctx_handle, transport_cl_thread ());
Florin Coras4b47ee22020-11-19 13:38:26 -08001208 ctx->parent_app_wrk_index = sep->app_wrk_index;
1209 ctx->parent_app_api_context = sep->opaque;
1210 ctx->tcp_is_ip4 = sep->is_ip4;
Florin Corasa54b62d2021-04-21 09:05:56 -07001211 ctx->ckpair_index = ccfg->ckpair_index;
Florin Coras4b47ee22020-11-19 13:38:26 -08001212 ctx->tls_type = sep->transport_proto;
1213 ctx->tls_ctx_handle = ctx_handle;
Florin Corasbab6c522021-05-13 08:36:56 -07001214 ctx->c_proto = TRANSPORT_PROTO_DTLS;
1215 ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
Florin Corasa54b62d2021-04-21 09:05:56 -07001216 if (ccfg->hostname[0])
Florin Coras4b47ee22020-11-19 13:38:26 -08001217 {
Florin Corasa54b62d2021-04-21 09:05:56 -07001218 ctx->srv_hostname = format (0, "%s", ccfg->hostname);
Florin Coras4b47ee22020-11-19 13:38:26 -08001219 vec_terminate_c_string (ctx->srv_hostname);
1220 }
1221
Florin Coras4b47ee22020-11-19 13:38:26 -08001222 ctx->tls_ctx_engine = engine_type;
1223
1224 clib_memcpy_fast (&cargs->sep, sep, sizeof (session_endpoint_t));
1225 cargs->sep.transport_proto = TRANSPORT_PROTO_UDP;
1226 cargs->app_index = tm->app_index;
1227 cargs->api_context = ctx_handle;
1228 cargs->sep_ext.ns_index = app->ns_index;
1229 cargs->sep_ext.transport_flags = TRANSPORT_CFG_F_CONNECTED;
1230 if ((rv = vnet_connect (cargs)))
1231 return rv;
1232
1233 TLS_DBG (1, "New DTLS connect request %x engine %d", ctx_handle,
1234 engine_type);
Florin Corasbab6c522021-05-13 08:36:56 -07001235 return ctx_handle;
1236}
1237
1238static transport_connection_t *
1239dtls_half_open_get (u32 ho_index)
1240{
1241 tls_ctx_t *ho_ctx;
Florin Corasfb50bc32021-05-18 00:28:59 -07001242 ho_ctx = tls_ctx_get_w_thread (ho_index, transport_cl_thread ());
Florin Corasbab6c522021-05-13 08:36:56 -07001243 return &ho_ctx->connection;
Florin Coras4b47ee22020-11-19 13:38:26 -08001244}
1245
1246static void
1247dtls_cleanup_callback (u32 ctx_index, u32 thread_index)
1248{
1249 /* No op */
1250}
1251
Florin Corasbab6c522021-05-13 08:36:56 -07001252static void
1253dtls_cleanup_ho (u32 ho_index)
1254{
1255 tls_ctx_t *ctx;
Florin Corasfb50bc32021-05-18 00:28:59 -07001256 ctx = tls_ctx_get_w_thread (ho_index, transport_cl_thread ());
Florin Corasbab6c522021-05-13 08:36:56 -07001257 tls_ctx_free (ctx);
1258}
1259
1260u8 *
1261format_dtls_half_open (u8 *s, va_list *args)
1262{
1263 u32 ho_index = va_arg (*args, u32);
1264 u32 __clib_unused thread_index = va_arg (*args, u32);
1265 tls_ctx_t *ho_ctx;
1266 session_t *us;
1267
Florin Corasfb50bc32021-05-18 00:28:59 -07001268 ho_ctx = tls_ctx_get_w_thread (ho_index, transport_cl_thread ());
Florin Corasbab6c522021-05-13 08:36:56 -07001269
1270 us = session_get_from_handle (ho_ctx->tls_session_handle);
1271 s = format (s, "[%d:%d][%s] half-open app_wrk %u engine %u us %d:%d",
1272 ho_ctx->c_thread_index, ho_ctx->c_s_index, "DTLS",
1273 ho_ctx->parent_app_wrk_index, ho_ctx->tls_ctx_engine,
1274 us->thread_index, us->session_index);
1275
1276 return s;
1277}
1278
Florin Coras4b47ee22020-11-19 13:38:26 -08001279static const transport_proto_vft_t dtls_proto = {
1280 .enable = 0,
1281 .connect = dtls_connect,
1282 .close = tls_disconnect,
1283 .start_listen = tls_start_listen,
1284 .stop_listen = tls_stop_listen,
1285 .get_connection = tls_connection_get,
1286 .get_listener = tls_listener_get,
Florin Corasbab6c522021-05-13 08:36:56 -07001287 .get_half_open = dtls_half_open_get,
Florin Coras4b47ee22020-11-19 13:38:26 -08001288 .custom_tx = tls_custom_tx_callback,
1289 .cleanup = dtls_cleanup_callback,
Florin Corasbab6c522021-05-13 08:36:56 -07001290 .cleanup_ho = dtls_cleanup_ho,
Florin Coras4b47ee22020-11-19 13:38:26 -08001291 .format_connection = format_tls_connection,
Florin Corasbab6c522021-05-13 08:36:56 -07001292 .format_half_open = format_dtls_half_open,
Florin Coras4b47ee22020-11-19 13:38:26 -08001293 .format_listener = format_tls_listener,
1294 .get_transport_endpoint = tls_transport_endpoint_get,
1295 .get_transport_listener_endpoint = tls_transport_listener_endpoint_get,
1296 .transport_options = {
1297 .name = "dtls",
1298 .short_name = "D",
1299 .tx_type = TRANSPORT_TX_INTERNAL,
Florin Corasbab6c522021-05-13 08:36:56 -07001300 .service_type = TRANSPORT_SERVICE_VC,
Florin Coras4b47ee22020-11-19 13:38:26 -08001301 },
1302};
Florin Coras371ca502018-02-21 12:07:41 -08001303
Florin Corasd77eee62018-03-07 08:49:27 -08001304void
Nathan Skrzypczak82fc5fd2019-09-13 10:20:15 +02001305tls_register_engine (const tls_engine_vft_t * vft, crypto_engine_type_t type)
Florin Coras371ca502018-02-21 12:07:41 -08001306{
Florin Corasd77eee62018-03-07 08:49:27 -08001307 vec_validate (tls_vfts, type);
1308 tls_vfts[type] = *vft;
Florin Coras371ca502018-02-21 12:07:41 -08001309}
1310
Dave Barachcc5677b2018-03-28 19:08:45 -04001311static clib_error_t *
Florin Coras371ca502018-02-21 12:07:41 -08001312tls_init (vlib_main_t * vm)
1313{
Florin Coras58d36f02018-03-09 13:05:53 -08001314 vlib_thread_main_t *vtm = vlib_get_thread_main ();
Florin Coras371ca502018-02-21 12:07:41 -08001315 tls_main_t *tm = &tls_main;
Florin Coras0a9ab822020-10-25 14:01:37 -07001316 u32 num_threads;
Florin Coras58d36f02018-03-09 13:05:53 -08001317
1318 num_threads = 1 /* main thread */ + vtm->n_threads;
Florin Coras371ca502018-02-21 12:07:41 -08001319
Florin Corasd77eee62018-03-07 08:49:27 -08001320 if (!tm->ca_cert_path)
1321 tm->ca_cert_path = TLS_CA_CERT_PATH;
1322
Florin Coras58d36f02018-03-09 13:05:53 -08001323 vec_validate (tm->rx_bufs, num_threads - 1);
1324 vec_validate (tm->tx_bufs, num_threads - 1);
1325
Florin Corasa3767bd2021-11-18 15:25:31 -08001326 tm->first_seg_size = 32 << 20;
1327 tm->add_seg_size = 256 << 20;
1328
Florin Coras371ca502018-02-21 12:07:41 -08001329 transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto,
1330 FIB_PROTOCOL_IP4, ~0);
1331 transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto,
1332 FIB_PROTOCOL_IP6, ~0);
Florin Coras4b47ee22020-11-19 13:38:26 -08001333
1334 transport_register_protocol (TRANSPORT_PROTO_DTLS, &dtls_proto,
1335 FIB_PROTOCOL_IP4, ~0);
1336 transport_register_protocol (TRANSPORT_PROTO_DTLS, &dtls_proto,
1337 FIB_PROTOCOL_IP6, ~0);
Florin Coras371ca502018-02-21 12:07:41 -08001338 return 0;
1339}
1340
1341VLIB_INIT_FUNCTION (tls_init);
1342
Florin Coras8f89dd02018-03-05 16:53:07 -08001343static clib_error_t *
1344tls_config_fn (vlib_main_t * vm, unformat_input_t * input)
1345{
1346 tls_main_t *tm = &tls_main;
Dave Wallaceb1a81aa2019-10-30 17:53:56 +00001347 uword tmp;
Florin Coras8f89dd02018-03-05 16:53:07 -08001348 while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
1349 {
1350 if (unformat (input, "use-test-cert-in-ca"))
1351 tm->use_test_cert_in_ca = 1;
1352 else if (unformat (input, "ca-cert-path %s", &tm->ca_cert_path))
1353 ;
Florin Corasddd98f32019-03-25 08:30:53 -07001354 else if (unformat (input, "first-segment-size %U", unformat_memory_size,
1355 &tm->first_seg_size))
1356 ;
Florin Corasa3767bd2021-11-18 15:25:31 -08001357 else if (unformat (input, "add-segment-size %U", unformat_memory_size,
1358 &tm->add_seg_size))
1359 ;
Dave Wallaceb1a81aa2019-10-30 17:53:56 +00001360 else if (unformat (input, "fifo-size %U", unformat_memory_size, &tmp))
1361 {
1362 if (tmp >= 0x100000000ULL)
1363 {
1364 return clib_error_return
1365 (0, "fifo-size %llu (0x%llx) too large", tmp, tmp);
1366 }
1367 tm->fifo_size = tmp;
1368 }
Florin Coras8f89dd02018-03-05 16:53:07 -08001369 else
1370 return clib_error_return (0, "unknown input `%U'",
1371 format_unformat_error, input);
1372 }
1373 return 0;
1374}
1375
Florin Coras1cbcdce2022-04-06 15:10:13 -07001376VLIB_CONFIG_FUNCTION (tls_config_fn, "tls");
Florin Corasd77eee62018-03-07 08:49:27 -08001377
1378tls_main_t *
1379vnet_tls_get_main (void)
1380{
1381 return &tls_main;
1382}
1383
Florin Coras371ca502018-02-21 12:07:41 -08001384/*
1385 * fd.io coding-style-patch-verification: ON
1386 *
1387 * Local Variables:
1388 * eval: (c-set-style "gnu")
1389 * End:
1390 */