FD.io VPP  v18.07.1-19-g511ce25
Vector Packet Processing
tls.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2018 Cisco and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
17 #include <vppinfra/lock.h>
18 #include <vnet/tls/tls.h>
19 
22 
23 #define TLS_INVALID_HANDLE ~0
24 #define TLS_IDX_MASK 0x00FFFFFF
25 #define TLS_ENGINE_TYPE_SHIFT 29
26 
27 void tls_disconnect (u32 ctx_handle, u32 thread_index);
28 
31 {
32  int i;
33  for (i = 0; i < vec_len (tls_vfts); i++)
34  {
35  if (tls_vfts[i].ctx_alloc)
36  return i;
37  }
38  return TLS_ENGINE_NONE;
39 }
40 
41 int
43 {
44  session_fifo_event_t evt;
45  svm_queue_t *q;
46 
47  if (svm_fifo_set_event (f))
48  {
49  evt.fifo = f;
50  evt.event_type = evt_type;
51 
52  q = session_manager_get_vpp_event_queue (f->master_thread_index);
53  if (PREDICT_TRUE (q->cursize < q->maxsize))
54  {
55  svm_queue_add (q, (u8 *) & evt, 0 /* do wait for mutex */ );
56  }
57  else
58  {
59  clib_warning ("vpp's evt q full");
60  return -1;
61  }
62  }
63  return 0;
64 }
65 
66 static inline int
68 {
69  session_fifo_event_t evt;
70  svm_queue_t *q;
71 
72  if (PREDICT_FALSE (app_session->session_state == SESSION_STATE_CLOSED))
73  {
74  /* Session is closed so app will never clean up. Flush rx fifo */
75  u32 to_dequeue = svm_fifo_max_dequeue (app_session->server_rx_fifo);
76  if (to_dequeue)
77  svm_fifo_dequeue_drop (app_session->server_rx_fifo, to_dequeue);
78  return 0;
79  }
80 
81  if (app->cb_fns.builtin_app_rx_callback)
82  return app->cb_fns.builtin_app_rx_callback (app_session);
83 
84  if (svm_fifo_set_event (app_session->server_rx_fifo))
85  {
86  evt.fifo = app_session->server_rx_fifo;
87  evt.event_type = FIFO_EVENT_APP_RX;
88  q = app->event_queue;
89 
90  if (PREDICT_TRUE (q->cursize < q->maxsize))
91  {
92  svm_queue_add (q, (u8 *) & evt, 0 /* do wait for mutex */ );
93  }
94  else
95  {
96  clib_warning ("app evt q full");
97  return -1;
98  }
99  }
100  return 0;
101 }
102 
103 u32
105 {
106  tls_main_t *tm = &tls_main;
107  tls_ctx_t *ctx;
108 
109  pool_get (tm->listener_ctx_pool, ctx);
110  memset (ctx, 0, sizeof (*ctx));
111  return ctx - tm->listener_ctx_pool;
112 }
113 
114 void
116 {
117  pool_put (tls_main.listener_ctx_pool, ctx);
118 }
119 
120 tls_ctx_t *
122 {
123  return pool_elt_at_index (tls_main.listener_ctx_pool, ctx_index);
124 }
125 
126 u32
128 {
129  return (ctx - tls_main.listener_ctx_pool);
130 }
131 
132 u32
134 {
135  tls_main_t *tm = &tls_main;
136  u8 will_expand = 0;
137  tls_ctx_t *ctx;
138  u32 ctx_index;
139 
140  pool_get_aligned_will_expand (tm->half_open_ctx_pool, will_expand, 0);
141  if (PREDICT_FALSE (will_expand && vlib_num_workers ()))
142  {
144  pool_get (tm->half_open_ctx_pool, ctx);
145  memset (ctx, 0, sizeof (*ctx));
146  ctx_index = ctx - tm->half_open_ctx_pool;
148  }
149  else
150  {
151  pool_get (tm->half_open_ctx_pool, ctx);
152  memset (ctx, 0, sizeof (*ctx));
153  ctx_index = ctx - tm->half_open_ctx_pool;
154  }
155  return ctx_index;
156 }
157 
158 void
160 {
161  tls_main_t *tm = &tls_main;
163  pool_put_index (tls_main.half_open_ctx_pool, ho_index);
165 }
166 
167 tls_ctx_t *
169 {
170  tls_main_t *tm = &tls_main;
172  return pool_elt_at_index (tm->half_open_ctx_pool, ctx_index);
173 }
174 
175 void
177 {
179 }
180 
181 u32
183 {
184  return (ctx - tls_main.half_open_ctx_pool);
185 }
186 
187 void
189 {
190  application_t *app;
191  app = application_get_if_valid (app_session->app_index);
192  if (PREDICT_TRUE (app != 0))
193  tls_add_app_q_evt (app, app_session);
194 }
195 
196 int
198 {
199  stream_session_t *app_listener, *app_session;
200  segment_manager_t *sm;
201  application_t *app;
202  tls_ctx_t *lctx;
203  int rv;
204 
205  app = application_get (ctx->parent_app_index);
206  lctx = tls_listener_ctx_get (ctx->listener_ctx_index);
207  app_listener = listen_session_get_from_handle (lctx->app_session_handle);
208  sm = application_get_listen_segment_manager (app, app_listener);
209 
210  app_session = session_alloc (vlib_get_thread_index ());
211  app_session->app_index = ctx->parent_app_index;
212  app_session->connection_index = ctx->tls_ctx_handle;
213  app_session->session_type = app_listener->session_type;
214  app_session->listener_index = app_listener->session_index;
215  if ((rv = session_alloc_fifos (sm, app_session)))
216  {
217  TLS_DBG (1, "failed to allocate fifos");
218  return rv;
219  }
220  ctx->c_s_index = app_session->session_index;
221  ctx->app_session_handle = session_handle (app_session);
222  return app->cb_fns.session_accept_callback (app_session);
223 }
224 
225 int
227 {
228  int (*cb_fn) (u32, u32, stream_session_t *, u8);
229  stream_session_t *app_session;
230  segment_manager_t *sm;
231  application_t *app;
232 
233  app = application_get (ctx->parent_app_index);
234  cb_fn = app->cb_fns.session_connected_callback;
235 
236  if (is_failed)
237  goto failed;
238 
240  app_session = session_alloc (vlib_get_thread_index ());
241  app_session->app_index = ctx->parent_app_index;
242  app_session->connection_index = ctx->tls_ctx_handle;
243  app_session->session_type =
245  if (session_alloc_fifos (sm, app_session))
246  goto failed;
247 
248  ctx->app_session_handle = session_handle (app_session);
249  ctx->c_s_index = app_session->session_index;
250  app_session->session_state = SESSION_STATE_READY;
251  if (cb_fn (ctx->parent_app_index, ctx->parent_app_api_context,
252  app_session, 0 /* not failed */ ))
253  {
254  TLS_DBG (1, "failed to notify app");
255  tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
256  }
257 
258  return 0;
259 
260 failed:
261  tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
262  return cb_fn (ctx->parent_app_index, ctx->parent_app_api_context, 0,
263  1 /* failed */ );
264 }
265 
266 static inline void
267 tls_ctx_parse_handle (u32 ctx_handle, u32 * ctx_index, u32 * engine_type)
268 {
269  *ctx_index = ctx_handle & TLS_IDX_MASK;
270  *engine_type = ctx_handle >> TLS_ENGINE_TYPE_SHIFT;
271 }
272 
273 static inline tls_engine_type_t
275 {
276  if (!tls_vfts[preferred].ctx_alloc)
277  return tls_get_available_engine ();
278  return preferred;
279 }
280 
281 static inline u32
283 {
284  u32 ctx_index;
285  ctx_index = tls_vfts[engine_type].ctx_alloc ();
286  return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index);
287 }
288 
289 static inline void
291 {
292  vec_free (ctx->srv_hostname);
293  tls_vfts[ctx->tls_ctx_engine].ctx_free (ctx);
294 }
295 
296 static inline tls_ctx_t *
297 tls_ctx_get (u32 ctx_handle)
298 {
299  u32 ctx_index, engine_type;
300  tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type);
301  return tls_vfts[engine_type].ctx_get (ctx_index);
302 }
303 
304 static inline tls_ctx_t *
305 tls_ctx_get_w_thread (u32 ctx_handle, u8 thread_index)
306 {
307  u32 ctx_index, engine_type;
308  tls_ctx_parse_handle (ctx_handle, &ctx_index, &engine_type);
309  return tls_vfts[engine_type].ctx_get_w_thread (ctx_index, thread_index);
310 }
311 
312 static inline int
314 {
315  return tls_vfts[ctx->tls_ctx_engine].ctx_init_server (ctx);
316 }
317 
318 static inline int
320 {
321  return tls_vfts[ctx->tls_ctx_engine].ctx_init_client (ctx);
322 }
323 
324 static inline int
326 {
327  return tls_vfts[ctx->tls_ctx_engine].ctx_write (ctx, app_session);
328 }
329 
330 static inline int
332 {
333  return tls_vfts[ctx->tls_ctx_engine].ctx_read (ctx, tls_session);
334 }
335 
336 static inline u8
338 {
339  return tls_vfts[ctx->tls_ctx_engine].ctx_handshake_is_over (ctx);
340 }
341 
342 void
344 {
345  clib_warning ("called...");
346 }
347 
348 int
349 tls_add_segment_callback (u32 client_index, const ssvm_private_t * fs)
350 {
351  /* No-op for builtin */
352  return 0;
353 }
354 
355 int
356 tls_del_segment_callback (u32 client_index, const ssvm_private_t * fs)
357 {
358  return 0;
359 }
360 
361 void
363 {
364  stream_session_t *app_session;
365  tls_ctx_t *ctx;
366  application_t *app;
367 
368  ctx = tls_ctx_get (tls_session->opaque);
369  if (!tls_ctx_handshake_is_over (ctx))
370  {
371  stream_session_disconnect (tls_session);
372  return;
373  }
374  ctx->is_passive_close = 1;
375  app = application_get (ctx->parent_app_index);
376  app_session = session_get_from_handle (ctx->app_session_handle);
377  app->cb_fns.session_disconnect_callback (app_session);
378 }
379 
380 int
382 {
383  stream_session_t *tls_listener;
384  tls_ctx_t *lctx, *ctx;
385  u32 ctx_handle;
386 
387  tls_listener = listen_session_get (tls_session->listener_index);
388  lctx = tls_listener_ctx_get (tls_listener->opaque);
389 
390  ctx_handle = tls_ctx_alloc (lctx->tls_ctx_engine);
391  ctx = tls_ctx_get (ctx_handle);
392  memcpy (ctx, lctx, sizeof (*lctx));
393  ctx->c_thread_index = vlib_get_thread_index ();
394  ctx->tls_ctx_handle = ctx_handle;
395  tls_session->session_state = SESSION_STATE_READY;
396  tls_session->opaque = ctx_handle;
397  ctx->tls_session_handle = session_handle (tls_session);
398  ctx->listener_ctx_index = tls_listener->opaque;
399 
400  TLS_DBG (1, "Accept on listener %u new connection [%u]%x",
401  tls_listener->opaque, vlib_get_thread_index (), ctx_handle);
402 
403  return tls_ctx_init_server (ctx);
404 }
405 
406 int
408 {
409  tls_ctx_t *ctx;
410  if (PREDICT_FALSE (app_session->session_state == SESSION_STATE_CLOSED))
411  return 0;
412  ctx = tls_ctx_get (app_session->connection_index);
413  tls_ctx_write (ctx, app_session);
414  return 0;
415 }
416 
417 int
419 {
420  tls_ctx_t *ctx;
421 
422  ctx = tls_ctx_get (tls_session->opaque);
423  tls_ctx_read (ctx, tls_session);
424  return 0;
425 }
426 
427 int
428 tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index,
429  stream_session_t * tls_session, u8 is_fail)
430 {
431  int (*cb_fn) (u32, u32, stream_session_t *, u8);
432  application_t *app;
433  tls_ctx_t *ho_ctx, *ctx;
434  u32 ctx_handle;
435 
436  ho_ctx = tls_ctx_half_open_get (ho_ctx_index);
437  app = application_get (ho_ctx->parent_app_index);
438  cb_fn = app->cb_fns.session_connected_callback;
439 
440  if (is_fail)
441  {
443  tls_ctx_half_open_free (ho_ctx_index);
444  return cb_fn (ho_ctx->parent_app_index, ho_ctx->c_s_index, 0,
445  1 /* failed */ );
446  }
447 
448  ctx_handle = tls_ctx_alloc (ho_ctx->tls_ctx_engine);
449  ctx = tls_ctx_get (ctx_handle);
450  clib_memcpy (ctx, ho_ctx, sizeof (*ctx));
452  tls_ctx_half_open_free (ho_ctx_index);
453 
454  ctx->c_thread_index = vlib_get_thread_index ();
455  ctx->tls_ctx_handle = ctx_handle;
456 
457  TLS_DBG (1, "TCP connect for %u returned %u. New connection [%u]%x",
458  ho_ctx_index, is_fail, vlib_get_thread_index (),
459  (ctx) ? ctx_handle : ~0);
460 
461  ctx->tls_session_handle = session_handle (tls_session);
462  tls_session->opaque = ctx_handle;
463  tls_session->session_state = SESSION_STATE_READY;
464 
465  return tls_ctx_init_client (ctx);
466 }
467 
468 /* *INDENT-OFF* */
470  .session_accept_callback = tls_session_accept_callback,
471  .session_disconnect_callback = tls_session_disconnect_callback,
472  .session_connected_callback = tls_session_connected_callback,
473  .session_reset_callback = tls_session_reset_callback,
474  .add_segment_callback = tls_add_segment_callback,
475  .del_segment_callback = tls_del_segment_callback,
476  .builtin_app_rx_callback = tls_app_rx_callback,
477  .builtin_app_tx_callback = tls_app_tx_callback,
478 };
479 /* *INDENT-ON* */
480 
481 int
483 {
485  tls_engine_type_t engine_type;
486  session_endpoint_t tls_sep;
487  tls_main_t *tm = &tls_main;
488  application_t *app;
489  tls_ctx_t *ctx;
490  u32 ctx_index;
491  int rv;
492 
493  sep = (session_endpoint_extended_t *) tep;
494  app = application_get (sep->app_index);
495  engine_type = tls_get_engine_type (app->tls_engine);
496  if (engine_type == TLS_ENGINE_NONE)
497  {
498  clib_warning ("No tls engine_type available");
499  return -1;
500  }
501 
502  ctx_index = tls_ctx_half_open_alloc ();
503  ctx = tls_ctx_half_open_get (ctx_index);
504  ctx->parent_app_index = sep->app_index;
505  ctx->parent_app_api_context = sep->opaque;
506  ctx->tcp_is_ip4 = sep->is_ip4;
507  if (sep->hostname)
508  {
509  ctx->srv_hostname = format (0, "%v", sep->hostname);
511  }
513 
515  ctx->tls_ctx_engine = engine_type;
516 
517  clib_memcpy (&tls_sep, sep, sizeof (tls_sep));
518  tls_sep.transport_proto = TRANSPORT_PROTO_TCP;
519  if ((rv = application_connect (tm->app_index, ctx_index, &tls_sep)))
520  return rv;
521 
522  TLS_DBG (1, "New connect request %u engine %d", ctx_index, engine_type);
523  return 0;
524 }
525 
526 void
527 tls_disconnect (u32 ctx_handle, u32 thread_index)
528 {
529  stream_session_t *tls_session, *app_session;
530  tls_ctx_t *ctx;
531 
532  TLS_DBG (1, "Disconnecting %x", ctx_handle);
533 
534  ctx = tls_ctx_get (ctx_handle);
535  tls_session = session_get_from_handle (ctx->tls_session_handle);
536  stream_session_disconnect (tls_session);
537 
538  app_session = session_get_from_handle_if_valid (ctx->app_session_handle);
539  if (app_session)
540  {
541  segment_manager_dealloc_fifos (app_session->svm_segment_index,
542  app_session->server_rx_fifo,
543  app_session->server_tx_fifo);
544  session_free (app_session);
545  }
546  tls_ctx_free (ctx);
547 }
548 
549 u32
550 tls_start_listen (u32 app_listener_index, transport_endpoint_t * tep)
551 {
552  tls_main_t *tm = &tls_main;
553  application_t *tls_app, *app;
554  session_handle_t tls_handle;
556  stream_session_t *tls_listener;
557  tls_ctx_t *lctx;
558  u32 lctx_index;
559  stream_session_t *app_listener;
560  tls_engine_type_t engine_type;
561 
562  sep = (session_endpoint_extended_t *) tep;
563  app = application_get (sep->app_index);
564  engine_type = tls_get_engine_type (app->tls_engine);
565  if (engine_type == TLS_ENGINE_NONE)
566  {
567  clib_warning ("No tls engine_type available");
568  return -1;
569  }
570 
571  lctx_index = tls_listener_ctx_alloc ();
572 
573  tls_app = application_get (tm->app_index);
574  sep->transport_proto = TRANSPORT_PROTO_TCP;
575  if (application_start_listen (tls_app, (session_endpoint_t *) sep,
576  &tls_handle))
577  return ~0;
578 
579  tls_listener = listen_session_get_from_handle (tls_handle);
580  tls_listener->opaque = lctx_index;
581 
582  app_listener = listen_session_get (app_listener_index);
583 
584  lctx = tls_listener_ctx_get (lctx_index);
585  lctx->parent_app_index = sep->app_index;
586  lctx->tls_session_handle = tls_handle;
587  lctx->app_session_handle = listen_session_get_handle (app_listener);
588  lctx->tcp_is_ip4 = sep->is_ip4;
589  lctx->tls_ctx_engine = engine_type;
590 
591  TLS_DBG (1, "Started listening %d, engine type %d", lctx_index,
592  engine_type);
593  return lctx_index;
594 }
595 
596 u32
597 tls_stop_listen (u32 lctx_index)
598 {
599  tls_main_t *tm = &tls_main;
600  application_t *tls_app;
601  tls_ctx_t *lctx;
602  lctx = tls_listener_ctx_get (lctx_index);
603  tls_app = application_get (tm->app_index);
604  application_stop_listen (tls_app, lctx->tls_session_handle);
605  tls_listener_ctx_free (lctx);
606  return 0;
607 }
608 
610 tls_connection_get (u32 ctx_index, u32 thread_index)
611 {
612  tls_ctx_t *ctx;
613  ctx = tls_ctx_get_w_thread (ctx_index, thread_index);
614  return &ctx->connection;
615 }
616 
618 tls_listener_get (u32 listener_index)
619 {
620  tls_ctx_t *ctx;
621  ctx = tls_listener_ctx_get (listener_index);
622  return &ctx->connection;
623 }
624 
625 u8 *
626 format_tls_ctx (u8 * s, va_list * args)
627 {
628  tls_ctx_t *ctx = va_arg (*args, tls_ctx_t *);
629  u32 thread_index = va_arg (*args, u32);
630  u32 child_si, child_ti;
631 
632  session_parse_handle (ctx->tls_session_handle, &child_si, &child_ti);
633  if (thread_index != child_ti)
634  clib_warning ("app and tls sessions are on different threads!");
635 
636  s = format (s, "[#%d][TLS] app %u child %u", child_ti,
637  ctx->parent_app_index, child_si);
638  return s;
639 }
640 
641 u8 *
642 format_tls_connection (u8 * s, va_list * args)
643 {
644  u32 ctx_index = va_arg (*args, u32);
645  u32 thread_index = va_arg (*args, u32);
646  u32 verbose = va_arg (*args, u32);
647  tls_ctx_t *ctx;
648 
649  ctx = tls_ctx_get_w_thread (ctx_index, thread_index);
650  if (!ctx)
651  return s;
652 
653  s = format (s, "%-50U", format_tls_ctx, ctx, thread_index);
654  if (verbose)
655  {
656  s = format (s, "%-15s", "state");
657  if (verbose > 1)
658  s = format (s, "\n");
659  }
660  return s;
661 }
662 
663 u8 *
664 format_tls_listener (u8 * s, va_list * args)
665 {
666  u32 tc_index = va_arg (*args, u32);
667  tls_ctx_t *ctx = tls_listener_ctx_get (tc_index);
668  u32 listener_index, thread_index;
669 
670  listen_session_parse_handle (ctx->tls_session_handle, &listener_index,
671  &thread_index);
672  return format (s, "[TLS] listener app %u child %u", ctx->parent_app_index,
673  listener_index);
674 }
675 
676 u8 *
677 format_tls_half_open (u8 * s, va_list * args)
678 {
679  u32 tc_index = va_arg (*args, u32);
680  tls_ctx_t *ctx = tls_ctx_half_open_get (tc_index);
681  s = format (s, "[TLS] half-open app %u", ctx->parent_app_index);
683  return s;
684 }
685 
686 /* *INDENT-OFF* */
688  .open = tls_connect,
689  .close = tls_disconnect,
690  .bind = tls_start_listen,
691  .get_connection = tls_connection_get,
692  .get_listener = tls_listener_get,
693  .unbind = tls_stop_listen,
694  .tx_type = TRANSPORT_TX_INTERNAL,
695  .service_type = TRANSPORT_SERVICE_APP,
696  .format_connection = format_tls_connection,
697  .format_half_open = format_tls_half_open,
698  .format_listener = format_tls_listener,
699 };
700 /* *INDENT-ON* */
701 
702 void
704 {
705  vec_validate (tls_vfts, type);
706  tls_vfts[type] = *vft;
707 }
708 
709 static clib_error_t *
711 {
713  vnet_app_attach_args_t _a, *a = &_a;
714  u64 options[APP_OPTIONS_N_OPTIONS];
715  u32 segment_size = 512 << 20;
716  tls_main_t *tm = &tls_main;
717  u32 fifo_size = 64 << 10;
718  u32 num_threads;
719 
720  num_threads = 1 /* main thread */ + vtm->n_threads;
721 
722  memset (a, 0, sizeof (*a));
723  memset (options, 0, sizeof (options));
724 
725  a->session_cb_vft = &tls_app_cb_vft;
726  a->api_client_index = APP_INVALID_INDEX;
727  a->options = options;
728  a->name = format (0, "tls");
729  a->options[APP_OPTIONS_SEGMENT_SIZE] = segment_size;
730  a->options[APP_OPTIONS_RX_FIFO_SIZE] = fifo_size;
731  a->options[APP_OPTIONS_TX_FIFO_SIZE] = fifo_size;
732  a->options[APP_OPTIONS_FLAGS] = APP_OPTIONS_FLAGS_IS_BUILTIN;
733  a->options[APP_OPTIONS_FLAGS] |= APP_OPTIONS_FLAGS_USE_GLOBAL_SCOPE;
734 
735  if (vnet_application_attach (a))
736  {
737  clib_warning ("failed to attach tls app");
738  return clib_error_return (0, "failed to attach tls app");
739  }
740 
741  if (!tm->ca_cert_path)
743 
744  tm->app_index = a->app_index;
746 
747  vec_validate (tm->rx_bufs, num_threads - 1);
748  vec_validate (tm->tx_bufs, num_threads - 1);
749 
751  FIB_PROTOCOL_IP4, ~0);
753  FIB_PROTOCOL_IP6, ~0);
754  vec_free (a->name);
755  return 0;
756 }
757 
759 
760 static clib_error_t *
762 {
763  tls_main_t *tm = &tls_main;
765  {
766  if (unformat (input, "use-test-cert-in-ca"))
767  tm->use_test_cert_in_ca = 1;
768  else if (unformat (input, "ca-cert-path %s", &tm->ca_cert_path))
769  ;
770  else
771  return clib_error_return (0, "unknown input `%U'",
772  format_unformat_error, input);
773  }
774  return 0;
775 }
776 
778 
779 tls_main_t *
781 {
782  return &tls_main;
783 }
784 
785 /*
786  * fd.io coding-style-patch-verification: ON
787  *
788  * Local Variables:
789  * eval: (c-set-style "gnu")
790  * End:
791  */
int tls_add_segment_callback(u32 client_index, const ssvm_private_t *fs)
Definition: tls.c:349
tls_main_t * vnet_tls_get_main(void)
Definition: tls.c:780
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
Definition: vec.h:437
static void clib_rwlock_reader_lock(clib_rwlock_t *p)
Definition: lock.h:139
static tls_main_t tls_main
Definition: tls.c:20
void tls_session_reset_callback(stream_session_t *s)
Definition: tls.c:343
static svm_queue_t * session_manager_get_vpp_event_queue(u32 thread_index)
Definition: session.h:553
static tls_engine_type_t tls_get_engine_type(tls_engine_type_t preferred)
Definition: tls.c:274
int svm_queue_add(svm_queue_t *q, u8 *elem, int nowait)
Definition: queue.c:184
enum tls_engine_type_ tls_engine_type_t
int tls_session_accept_callback(stream_session_t *tls_session)
Definition: tls.c:381
a
Definition: bitmap.h:538
static const transport_proto_vft_t tls_proto
Definition: tls.c:687
static void clib_rwlock_writer_lock(clib_rwlock_t *p)
Definition: lock.h:177
#define TLS_ENGINE_TYPE_SHIFT
Definition: tls.c:25
struct _transport_connection transport_connection_t
u32 tls_ctx_half_open_alloc(void)
Definition: tls.c:133
u32 tls_listener_ctx_alloc(void)
Definition: tls.c:104
#define PREDICT_TRUE(x)
Definition: clib.h:106
int tls_app_rx_callback(stream_session_t *tls_session)
Definition: tls.c:418
clib_rwlock_t half_open_rwlock
Definition: tls.h:80
unsigned long u64
Definition: types.h:89
char * ca_cert_path
Definition: tls.h:88
int application_stop_listen(application_t *srv, session_handle_t handle)
Stop listening on session associated to handle.
Definition: application.c:477
int(* ctx_init_server)(tls_ctx_t *ctx)
Definition: tls.h:98
int application_connect(u32 client_index, u32 api_context, session_endpoint_t *sep)
static clib_error_t * tls_config_fn(vlib_main_t *vm, unformat_input_t *input)
Definition: tls.c:761
#define pool_get_aligned_will_expand(P, YESNO, A)
See if pool_get will expand the pool or not.
Definition: pool.h:231
struct _transport_proto_vft transport_proto_vft_t
#define vec_terminate_c_string(V)
(If necessary) NULL terminate a vector containing a c-string.
Definition: vec.h:1016
int tls_connect(transport_endpoint_t *tep)
Definition: tls.c:482
tls_ctx_t *(* ctx_get_w_thread)(u32 ctx_index, u8 thread_index)
Definition: tls.h:96
u8 * format_tls_connection(u8 *s, va_list *args)
Definition: tls.c:642
int i
void tls_notify_app_enqueue(tls_ctx_t *ctx, stream_session_t *app_session)
Definition: tls.c:188
void(* ctx_free)(tls_ctx_t *ctx)
Definition: tls.h:94
int(* ctx_init_client)(tls_ctx_t *ctx)
Definition: tls.h:97
u8 use_test_cert_in_ca
Definition: tls.h:87
transport_connection_t * tls_connection_get(u32 ctx_index, u32 thread_index)
Definition: tls.c:610
static void session_parse_handle(session_handle_t handle, u32 *index, u32 *thread_index)
Definition: session.h:328
u8 * format(u8 *s, const char *fmt,...)
Definition: format.c:419
void segment_manager_dealloc_fifos(u32 segment_index, svm_fifo_t *rx_fifo, svm_fifo_t *tx_fifo)
u64 session_handle_t
Definition: session.h:91
static stream_session_t * session_get_from_handle(session_handle_t handle)
Definition: session.h:336
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
Definition: pool.h:228
static tls_ctx_t * tls_ctx_get_w_thread(u32 ctx_handle, u8 thread_index)
Definition: tls.c:305
unsigned char u8
Definition: types.h:56
static stream_session_t * listen_session_get_from_handle(session_handle_t handle)
Definition: session.h:569
app transport service
struct _svm_fifo svm_fifo_t
void session_free(stream_session_t *s)
Definition: session.c:108
u32 app_index
Definition: tls.h:77
segment_manager_t * application_get_listen_segment_manager(application_t *app, stream_session_t *s)
Definition: application.c:550
static void tls_ctx_free(tls_ctx_t *ctx)
Definition: tls.c:290
void tls_listener_ctx_free(tls_ctx_t *ctx)
Definition: tls.c:115
#define VLIB_INIT_FUNCTION(x)
Definition: init.h:156
int(* ctx_read)(tls_ctx_t *ctx, stream_session_t *tls_session)
Definition: tls.h:99
int tls_app_tx_callback(stream_session_t *app_session)
Definition: tls.c:407
u8 * format_tls_listener(u8 *s, va_list *args)
Definition: tls.c:664
static tls_engine_vft_t * tls_vfts
Definition: tls.c:21
static u32 svm_fifo_max_dequeue(svm_fifo_t *f)
Definition: svm_fifo.h:105
struct _stream_session_cb_vft session_cb_vft_t
static stream_session_t * listen_session_get(u32 index)
Definition: session.h:592
u8 is_passive_close
Definition: tls.h:70
#define clib_error_return(e, args...)
Definition: error.h:99
static void tls_ctx_parse_handle(u32 ctx_handle, u32 *ctx_index, u32 *engine_type)
Definition: tls.c:267
unsigned int u32
Definition: types.h:88
struct _stream_session_t stream_session_t
tls_ctx_t *(* ctx_get)(u32 ctx_index)
Definition: tls.h:95
static u8 tls_ctx_handshake_is_over(tls_ctx_t *ctx)
Definition: tls.c:337
struct _vnet_app_attach_args_t vnet_app_attach_args_t
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
Definition: pool.h:464
static void clib_rwlock_init(clib_rwlock_t *p)
Definition: lock.h:122
#define TLS_IDX_MASK
Definition: tls.c:24
struct _session_endpoint session_endpoint_t
u32 tls_listener_ctx_index(tls_ctx_t *ctx)
Definition: tls.c:127
static void clib_rwlock_reader_unlock(clib_rwlock_t *p)
Definition: lock.h:157
u8(* ctx_handshake_is_over)(tls_ctx_t *ctx)
Definition: tls.h:101
void tls_ctx_half_open_reader_unlock()
Definition: tls.c:176
struct _unformat_input_t unformat_input_t
static int tls_add_app_q_evt(application_t *app, stream_session_t *app_session)
Definition: tls.c:67
Definition: tls.h:75
static session_handle_t session_handle(stream_session_t *s)
Definition: session.h:310
#define pool_put(P, E)
Free an object E in pool P.
Definition: pool.h:274
#define APP_INVALID_INDEX
Definition: application.h:135
int tls_notify_app_connected(tls_ctx_t *ctx, u8 is_failed)
Definition: tls.c:226
#define PREDICT_FALSE(x)
Definition: clib.h:105
Definition: tls.h:52
u32(* ctx_alloc)(void)
Definition: tls.h:93
int session_alloc_fifos(segment_manager_t *sm, stream_session_t *s)
Definition: session.c:116
static void clib_rwlock_writer_unlock(clib_rwlock_t *p)
Definition: lock.h:185
static u8 svm_fifo_set_event(svm_fifo_t *f)
Sets fifo event flag.
Definition: svm_fifo.h:134
u8 * format_tls_ctx(u8 *s, va_list *args)
Definition: tls.c:626
#define VLIB_EARLY_CONFIG_FUNCTION(x, n,...)
Definition: init.h:195
#define UNFORMAT_END_OF_INPUT
Definition: format.h:144
u8 ** rx_bufs
Definition: tls.h:81
tls_engine_type_t tls_get_available_engine(void)
Definition: tls.c:30
static_always_inline uword vlib_get_thread_index(void)
Definition: threads.h:221
void tls_disconnect(u32 ctx_handle, u32 thread_index)
Definition: tls.c:527
int tls_del_segment_callback(u32 client_index, const ssvm_private_t *fs)
Definition: tls.c:356
static session_type_t session_type_from_proto_and_ip(transport_proto_t proto, u8 is_ip4)
Definition: session.h:386
vlib_main_t * vm
Definition: buffer.c:294
transport_connection_t * tls_listener_get(u32 listener_index)
Definition: tls.c:618
static int tls_ctx_read(tls_ctx_t *ctx, stream_session_t *tls_session)
Definition: tls.c:331
#define vec_free(V)
Free vector&#39;s memory (no header).
Definition: vec.h:339
segment_manager_t * application_get_connect_segment_manager(application_t *app)
Definition: application.c:543
#define clib_warning(format, args...)
Definition: error.h:59
#define clib_memcpy(a, b, c)
Definition: string.h:75
apps acting as transports
transport_connection_t connection
Definition: tls.h:56
static int tls_ctx_init_client(tls_ctx_t *ctx)
Definition: tls.c:319
int application_start_listen(application_t *srv, session_endpoint_t *sep, session_handle_t *res)
Start listening local transport endpoint for requested transport.
Definition: application.c:436
struct _application application_t
#define TLS_DBG(_fmt, _args...)
Definition: tls.h:35
void tls_register_engine(const tls_engine_vft_t *vft, tls_engine_type_t type)
Definition: tls.c:703
void transport_register_protocol(transport_proto_t transport_proto, const transport_proto_vft_t *vft, fib_protocol_t fib_proto, u32 output_node)
Register transport virtual function table.
Definition: transport.c:173
static tls_ctx_t * tls_ctx_get(u32 ctx_handle)
Definition: tls.c:297
static stream_session_t * session_get_from_handle_if_valid(session_handle_t handle)
Definition: session.h:345
static int tls_ctx_init_server(tls_ctx_t *ctx)
Definition: tls.c:313
#define pool_put_index(p, i)
Free pool element with given index.
Definition: pool.h:299
long ctx[MAX_CONNS]
Definition: main.c:126
void stream_session_disconnect(stream_session_t *s)
Initialize session disconnect.
Definition: session.c:1090
tls_ctx_t * tls_listener_ctx_get(u32 ctx_index)
Definition: tls.c:121
tls_ctx_t * half_open_ctx_pool
Definition: tls.h:79
stream_session_t * session_alloc(u32 thread_index)
Definition: session.c:81
u8 ** tx_bufs
Definition: tls.h:82
u32 tls_stop_listen(u32 lctx_index)
Definition: tls.c:597
int svm_fifo_dequeue_drop(svm_fifo_t *f, u32 max_bytes)
Definition: svm_fifo.c:792
int tls_session_connected_callback(u32 tls_app_index, u32 ho_ctx_index, stream_session_t *tls_session, u8 is_fail)
Definition: tls.c:428
u32 tls_ctx_half_open_index(tls_ctx_t *ctx)
Definition: tls.c:182
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
clib_error_t * vnet_application_attach(vnet_app_attach_args_t *a)
Attach application to vpp.
int(* ctx_write)(tls_ctx_t *ctx, stream_session_t *app_session)
Definition: tls.h:100
application_t * application_get(u32 index)
Definition: application.c:386
struct _transport_endpoint transport_endpoint_t
int tls_add_vpp_q_evt(svm_fifo_t *f, u8 evt_type)
Definition: tls.c:42
struct _segment_manager segment_manager_t
u8 * srv_hostname
Definition: tls.h:72
struct _svm_queue svm_queue_t
int tls_notify_app_accept(tls_ctx_t *ctx)
Definition: tls.c:197
void tls_ctx_half_open_free(u32 ho_index)
Definition: tls.c:159
u8 * format_unformat_error(u8 *s, va_list *va)
Definition: unformat.c:91
static vlib_thread_main_t * vlib_get_thread_main()
Definition: global_funcs.h:32
static u32 vlib_num_workers()
Definition: threads.h:375
static u32 tls_ctx_alloc(tls_engine_type_t engine_type)
Definition: tls.c:282
void tls_session_disconnect_callback(stream_session_t *tls_session)
Definition: tls.c:362
int application_alloc_connects_segment_manager(application_t *app)
Definition: application.c:528
static int tls_ctx_write(tls_ctx_t *ctx, stream_session_t *app_session)
Definition: tls.c:325
#define TLS_CA_CERT_PATH
Definition: tls.h:28
u8 * format_tls_half_open(u8 *s, va_list *args)
Definition: tls.c:677
static clib_error_t * tls_init(vlib_main_t *vm)
Definition: tls.c:710
static session_cb_vft_t tls_app_cb_vft
Definition: tls.c:469
static u64 listen_session_get_handle(stream_session_t *s)
Definition: session.h:562
u32 tls_start_listen(u32 app_listener_index, transport_endpoint_t *tep)
Definition: tls.c:550
struct _session_endpoint_extended session_endpoint_extended_t
tls_ctx_t * listener_ctx_pool
Definition: tls.h:78
application_t * application_get_if_valid(u32 index)
Definition: application.c:394
uword unformat(unformat_input_t *i, const char *fmt,...)
Definition: unformat.c:972
tls_ctx_t * tls_ctx_half_open_get(u32 ctx_index)
Definition: tls.c:168
static uword unformat_check_input(unformat_input_t *i)
Definition: format.h:170
static void listen_session_parse_handle(session_handle_t handle, u32 *index, u32 *thread_index)
Definition: session.h:575