16 #include <openssl/ssl.h> 17 #include <openssl/conf.h> 18 #include <openssl/err.h> 20 #ifdef HAVE_OPENSSL_ASYNC 21 #include <openssl/async.h> 25 #include <vpp/app/version.h> 30 #define MAX_CRYPTO_LEN 64 45 (*ctx)->ctx.c_thread_index = thread_index;
48 (*ctx)->openssl_ctx_index = ctx - tm->
ctx_pool[thread_index];
49 return ((*ctx)->openssl_ctx_index);
58 SSL_shutdown (oc->
ssl);
112 u32 deq_max, deq_now;
143 u32 enq_max, deq_now;
147 if (BIO_ctrl_pending (oc->
rbio) <= 0)
177 #ifdef HAVE_OPENSSL_ASYNC 179 vpp_ssl_async_process_event (
tls_ctx_t * ctx,
188 SSL_set_async_callback_arg (oc->
ssl, (
void *) engine_cb->
arg);
218 ctx->no_app_session = 1;
236 #ifdef HAVE_OPENSSL_ASYNC 241 while (SSL_in_init (oc->
ssl))
252 #ifdef HAVE_OPENSSL_ASYNC 254 vpp_ssl_async_process_event (ctx, myself);
257 rv = SSL_do_handshake (oc->
ssl);
258 err = SSL_get_error (oc->
ssl, rv);
260 if (err == SSL_ERROR_SSL)
263 ERR_error_string (ERR_get_error (), buf);
271 #ifdef HAVE_OPENSSL_ASYNC 272 if (err == SSL_ERROR_WANT_ASYNC)
274 SSL_get_async_status (oc->
ssl, &estatus);
276 if (estatus == ASYNC_STATUS_EAGAIN)
278 vpp_ssl_async_retry_func (ctx, myself);
283 if (err != SSL_ERROR_WANT_WRITE)
287 SSL_state_string_long (oc->
ssl));
289 if (SSL_in_init (oc->
ssl))
295 if (!SSL_is_server (oc->
ssl))
300 if ((rv = SSL_get_verify_result (oc->
ssl)) != X509_V_OK)
302 TLS_DBG (1,
" failed verify: %s\n",
303 X509_verify_cert_error_string (rv));
321 TLS_DBG (1,
"Handshake for %u complete. TLS cipher is %s",
337 int wrote = 0, rv, read, max_buf = 100 *
TLS_CHUNK_SIZE, max_space;
338 u32 enq_max, deq_max, deq_now, to_write;
347 max_space = max_buf - BIO_ctrl_pending (oc->
rbio);
348 max_space = (max_space < 0) ? 0 : max_space;
377 if (BIO_ctrl_pending (oc->
rbio) <= 0)
400 if (read < enq_max && BIO_ctrl_pending (oc->
rbio) > 0)
408 if (BIO_ctrl_pending (oc->
rbio) > 0)
419 int read, wrote = 0, max_space, max_buf = 100 *
TLS_CHUNK_SIZE, rv;
421 u32 deq_max, enq_max, deq_now, to_read;
435 max_space = max_buf - BIO_ctrl_pending (oc->
wbio);
436 max_space = max_space < 0 ? 0 : max_space;
437 deq_now =
clib_min (deq_max, max_space);
464 if (BIO_ctrl_pending (oc->
wbio) <= 0)
484 if (read < enq_max && SSL_pending (oc->
ssl) > 0)
495 if (SSL_pending (oc->
ssl) > 0)
504 long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
508 const SSL_METHOD *method;
510 #ifdef HAVE_OPENSSL_ASYNC 514 method = SSLv23_client_method ();
517 TLS_DBG (1,
"SSLv23_method returned null");
521 oc->
ssl_ctx = SSL_CTX_new (method);
524 TLS_DBG (1,
"SSL_CTX_new returned null");
528 SSL_CTX_set_ecdh_auto (oc->
ssl_ctx, 1);
529 SSL_CTX_set_mode (oc->
ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
530 #ifdef HAVE_OPENSSL_ASYNC 532 SSL_CTX_set_mode (oc->
ssl_ctx, SSL_MODE_ASYNC);
534 rv = SSL_CTX_set_cipher_list (oc->
ssl_ctx, (
const char *) om->
ciphers);
537 TLS_DBG (1,
"Couldn't set cipher");
541 SSL_CTX_set_options (oc->
ssl_ctx, flags);
547 TLS_DBG (1,
"Couldn't initialize ssl struct");
551 oc->
rbio = BIO_new (BIO_s_mem ());
552 oc->
wbio = BIO_new (BIO_s_mem ());
554 BIO_set_mem_eof_return (oc->
rbio, -1);
555 BIO_set_mem_eof_return (oc->
wbio, -1);
558 SSL_set_connect_state (oc->
ssl);
563 TLS_DBG (1,
"Couldn't set hostname");
570 TLS_DBG (1,
"Initiating handshake for [%u]%u", ctx->c_thread_index,
576 rv = SSL_do_handshake (oc->
ssl);
577 err = SSL_get_error (oc->
ssl, rv);
579 #ifdef HAVE_OPENSSL_ASYNC 580 if (err == SSL_ERROR_WANT_ASYNC)
583 vpp_ssl_async_process_event (ctx, handler);
587 if (err != SSL_ERROR_WANT_WRITE)
591 TLS_DBG (2,
"tls state for [%u]%u is su", ctx->c_thread_index,
599 const SSL_METHOD *method;
609 long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
616 if (!ckpair->
cert || !ckpair->
key)
618 TLS_DBG (1,
"tls cert and/or key not configured %d",
619 lctx->parent_app_wrk_index);
623 method = SSLv23_method ();
624 ssl_ctx = SSL_CTX_new (method);
631 SSL_CTX_set_mode (ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
632 #ifdef HAVE_OPENSSL_ASYNC 634 SSL_CTX_set_mode (ssl_ctx, SSL_MODE_ASYNC);
637 SSL_CTX_set_options (ssl_ctx, flags);
638 SSL_CTX_set_ecdh_auto (ssl_ctx, 1);
640 rv = SSL_CTX_set_cipher_list (ssl_ctx, (
const char *) om->
ciphers);
643 TLS_DBG (1,
"Couldn't set cipher");
650 cert_bio = BIO_new (BIO_s_mem ());
652 srvcert = PEM_read_bio_X509 (cert_bio,
NULL,
NULL,
NULL);
658 SSL_CTX_use_certificate (ssl_ctx, srvcert);
661 cert_bio = BIO_new (BIO_s_mem ());
663 pkey = PEM_read_bio_PrivateKey (cert_bio,
NULL,
NULL,
NULL);
669 SSL_CTX_use_PrivateKey (ssl_ctx, pkey);
679 lctx->tls_ssl_ctx = olc_index;
691 olc_index = lctx->tls_ssl_ctx;
695 EVP_PKEY_free (olc->
pkey);
707 u32 olc_index = ctx->tls_ssl_ctx;
711 #ifdef HAVE_OPENSSL_ASYNC 721 TLS_DBG (1,
"Couldn't initialize ssl struct");
725 oc->
rbio = BIO_new (BIO_s_mem ());
726 oc->
wbio = BIO_new (BIO_s_mem ());
728 BIO_set_mem_eof_return (oc->
rbio, -1);
729 BIO_set_mem_eof_return (oc->
wbio, -1);
732 SSL_set_accept_state (oc->
ssl);
734 TLS_DBG (1,
"Initiating handshake for [%u]%u", ctx->c_thread_index,
740 rv = SSL_do_handshake (oc->
ssl);
741 err = SSL_get_error (oc->
ssl, rv);
743 #ifdef HAVE_OPENSSL_ASYNC 744 if (err == SSL_ERROR_WANT_ASYNC)
747 vpp_ssl_async_process_event (ctx, handler);
751 if (err != SSL_ERROR_WANT_WRITE)
755 TLS_DBG (2,
"tls state for [%u]%u is su", ctx->c_thread_index,
766 return SSL_is_init_finished (mc->
ssl);
789 if (BIO_ctrl_pending (oc->
rbio) <= 0
824 clib_warning (
"Could not initialize TLS CA certificates");
834 #if OPENSSL_VERSION_NUMBER >= 0x30000000L 847 cert_bio = BIO_new (BIO_s_mem ());
849 testcert = PEM_read_bio_X509 (cert_bio,
NULL,
NULL,
NULL);
855 X509_STORE_add_cert (om->
cert_store, testcert);
858 return (rv < 0 ? -1 : 0);
875 om->
ciphers[
i] = toupper (ciphers[i]);
894 SSL_load_error_strings ();
910 (
"ALL:!ADH:!LOW:!EXP:!MD5:!RC4-SHA:!DES-CBC3-SHA:@STRENGTH");
921 #ifdef HAVE_OPENSSL_ASYNC 927 char *engine_name =
NULL;
928 char *engine_alg =
NULL;
929 char *ciphers =
NULL;
930 u8 engine_name_set = 0;
938 (0,
"engine has started, and no config is accepted");
943 if (
unformat (input,
"engine %s", &engine_name))
952 else if (
unformat (input,
"alg %s", &engine_alg))
955 engine_alg[i] = toupper (engine_alg[i]);
957 else if (
unformat (input,
"ciphers %s", &ciphers))
967 if (!engine_name_set)
987 .path =
"tls openssl set",
988 .short_help =
"tls openssl set [engine <engine name>] [alg [algorithm] [async]",
989 .function = tls_openssl_set_command_fn,
996 .version = VPP_BUILD_VER,
997 .description =
"Transport Layer Security (TLS) Engine, OpenSSL Based",
tls_main_t * vnet_tls_get_main(void)
#define vec_validate(V, I)
Make sure vector is long enough for given index (no header, unspecified alignment) ...
openssl_listen_ctx_t * lctx_pool
int(* callback)(SSL *ssl, void *arg)
static int openssl_transport_close(tls_ctx_t *ctx)
static u8 openssl_handshake_is_over(tls_ctx_t *ctx)
static u32 svm_fifo_max_enqueue_prod(svm_fifo_t *f)
Maximum number of bytes that can be enqueued into fifo.
void tls_disconnect_transport(tls_ctx_t *ctx)
static void openssl_handle_handshake_failure(tls_ctx_t *ctx)
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
svm_fifo_t * rx_fifo
Pointers to rx/tx buffers.
void openssl_async_node_enable_disable(u8 is_en)
int tls_add_vpp_q_builtin_rx_evt(session_t *s)
static u32 openssl_ctx_alloc(void)
int tls_openssl_set_ciphers(char *ciphers)
static void openssl_listen_ctx_free(openssl_listen_ctx_t *lctx)
int tls_async_openssl_callback(SSL *s, void *evt)
void svm_fifo_enqueue_nocopy(svm_fifo_t *f, u32 len)
Advance tail.
static void openssl_ctx_free(tls_ctx_t *ctx)
static session_t * session_get(u32 si, u32 thread_index)
clib_error_t * tls_openssl_api_init(vlib_main_t *vm)
#define pool_get(P, E)
Allocate an object E from a pool P (unspecified alignment).
void tls_register_engine(const tls_engine_vft_t *vft, crypto_engine_type_t type)
static u8 * svm_fifo_tail(svm_fifo_t *f)
struct _svm_fifo svm_fifo_t
void session_transport_closing_notify(transport_connection_t *tc)
Notification from transport that connection is being closed.
#define VLIB_INIT_FUNCTION(x)
static u32 svm_fifo_max_dequeue_cons(svm_fifo_t *f)
Fifo max bytes to dequeue optimized for consumer.
int openssl_engine_register(char *engine_name, char *algorithm)
#define clib_error_return(e, args...)
static int openssl_stop_listen(tls_ctx_t *lctx)
static u32 svm_fifo_max_write_chunk(svm_fifo_t *f)
Max contiguous chunk of data that can be written.
#define SESSION_INVALID_HANDLE
static u8 * svm_fifo_head(svm_fifo_t *f)
int tls_add_vpp_q_builtin_tx_evt(session_t *s)
static u32 svm_fifo_max_read_chunk(svm_fifo_t *f)
Max contiguous chunk of data that can be read.
int tls_init_ca_chain(void)
int session_dequeue_notify(session_t *s)
#define pool_elt_at_index(p, i)
Returns pointer to element at given index.
int vpp_add_async_run_event(tls_ctx_t *ctx, openssl_resume_handler *handler)
static session_t * session_get_from_handle(session_handle_t handle)
int tls_notify_app_connected(tls_ctx_t *ctx, u8 is_failed)
tls_ctx_t * openssl_ctx_get(u32 ctx_index)
#define SESSION_INVALID_INDEX
static const char test_srv_crt_rsa[]
static int openssl_ctx_init_client(tls_ctx_t *ctx)
app_cert_key_pair_t * app_cert_key_pair_get_if_valid(u32 index)
static u8 svm_fifo_needs_deq_ntf(svm_fifo_t *f, u32 n_last_deq)
Check if fifo needs dequeue notification.
static_always_inline uword vlib_get_thread_index(void)
static int openssl_app_close(tls_ctx_t *ctx)
#define vec_free(V)
Free vector's memory (no header).
void session_free(session_t *s)
openssl_ctx_t *** ctx_pool
#define clib_warning(format, args...)
static int openssl_ctx_write(tls_ctx_t *ctx, session_t *app_session)
static int openssl_try_handshake_write(openssl_ctx_t *oc, session_t *tls_session)
static int openssl_ctx_read(tls_ctx_t *ctx, session_t *tls_session)
openssl_main_t openssl_main
int tls_add_vpp_q_tx_evt(session_t *s)
transport_connection_t connection
#define VLIB_CLI_COMMAND(x,...)
#define pool_put_index(p, i)
Free pool element with given index.
static void openssl_confirm_app_close(tls_ctx_t *ctx)
int openssl_resume_handler(tls_ctx_t *ctx, session_t *tls_session)
static clib_error_t * tls_openssl_init(vlib_main_t *vm)
static void * clib_mem_alloc(uword size)
tls_ctx_t * openssl_ctx_get_w_thread(u32 ctx_index, u8 thread_index)
static int openssl_ctx_init_server(tls_ctx_t *ctx)
openssl_tls_callback_t * vpp_add_async_pending_event(tls_ctx_t *ctx, openssl_resume_handler *handler)
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
volatile u8 session_state
State in session layer state machine.
void session_transport_closed_notify(transport_connection_t *tc)
Notification from transport that it is closed.
static int openssl_start_listen(tls_ctx_t *lctx)
int openssl_ctx_handshake_rx(tls_ctx_t *ctx, session_t *tls_session)
int tls_notify_app_accept(tls_ctx_t *ctx)
void tls_notify_app_enqueue(tls_ctx_t *ctx, session_t *app_session)
static int openssl_try_handshake_read(openssl_ctx_t *oc, session_t *tls_session)
static vlib_thread_main_t * vlib_get_thread_main()
openssl_listen_ctx_t * openssl_lctx_get(u32 lctx_index)
static u32 openssl_listen_ctx_alloc(void)
int svm_fifo_dequeue_drop(svm_fifo_t *f, u32 len)
Dequeue and drop bytes from fifo.
#define TLS_DBG(_lvl, _fmt, _args...)
static const u32 test_srv_crt_rsa_len