4 #include "tls_picotls.h"
5 #include "pico_vpp_crypto.h"
7 picotls_main_t picotls_main;
9 #define MAX_QUEUE 12000
10 #define PTLS_MAX_PLAINTEXT_RECORD_SIZE 16384
13 picotls_ctx_alloc (void)
15 u8 thread_id = vlib_get_thread_index ();
16 picotls_main_t *pm = &picotls_main;
19 pool_get (pm->ctx_pool[thread_id], ctx);
21 *ctx = clib_mem_alloc (sizeof (picotls_ctx_t));
23 clib_memset (*ctx, 0, sizeof (picotls_ctx_t));
24 (*ctx)->ctx.c_thread_index = thread_id;
25 (*ctx)->ctx.tls_ctx_engine = CRYPTO_ENGINE_PICOTLS;
26 (*ctx)->ctx.app_session_handle = SESSION_INVALID_HANDLE;
27 (*ctx)->ptls_ctx_idx = ctx - pm->ctx_pool[thread_id];
28 return (*ctx)->ptls_ctx_idx;
32 picotls_ctx_free (tls_ctx_t * ctx)
34 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
35 vec_free (ptls_ctx->rx_content);
36 vec_free (ptls_ctx->write_content);
37 pool_put_index (picotls_main.ctx_pool[ctx->c_thread_index],
38 ptls_ctx->ptls_ctx_idx);
42 picotls_listen_ctx_alloc (void)
44 picotls_main_t *pm = &picotls_main;
45 picotls_listen_ctx_t *ptls_lctx;
47 pool_get (pm->lctx_pool, ptls_lctx);
49 clib_memset (ptls_lctx, 0, sizeof (picotls_listen_ctx_t));
50 ptls_lctx->ptls_lctx_index = ptls_lctx - pm->lctx_pool;
51 return ptls_lctx->ptls_lctx_index;
55 picotls_listen_ctx_free (picotls_listen_ctx_t * lctx)
57 pool_put_index (picotls_main.lctx_pool, lctx->ptls_lctx_index);
61 picotls_ctx_get (u32 ctx_index)
65 pool_elt_at_index (picotls_main.ctx_pool[vlib_get_thread_index ()],
70 picotls_listen_ctx_t *
71 picotls_lctx_get (u32 lctx_index)
73 return pool_elt_at_index (picotls_main.lctx_pool, lctx_index);
77 picotls_handshake_is_over (tls_ctx_t * ctx)
79 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
80 assert (ptls_ctx->tls);
81 return ptls_handshake_is_complete (ptls_ctx->tls);
85 picotls_try_handshake_write (picotls_ctx_t * ptls_ctx,
86 session_t * tls_session, ptls_buffer_t * buf)
95 f = tls_session->tx_fifo;
97 enq_max = svm_fifo_max_enqueue_prod (f);
101 enq_now = clib_min (svm_fifo_max_write_chunk (f), enq_max);
102 enq_now = clib_min (enq_now, buf_left);
103 write = svm_fifo_enqueue (f, enq_now, buf->base);
105 tls_add_vpp_q_tx_evt (tls_session);
110 picotls_start_listen (tls_ctx_t * lctx)
112 picotls_listen_ctx_t *ptls_lctx;
113 ptls_context_t *ptls_ctx;
115 app_cert_key_pair_t *ckpair;
116 static ptls_key_exchange_algorithm_t *key_exchange[] = {
117 #ifdef PTLS_OPENSSL_HAVE_X25519
118 &ptls_openssl_x25519,
120 #ifdef PTLS_OPENSSL_HAVE_SECP256r1
121 &ptls_openssl_secp256r1,
123 #ifdef PTLS_OPENSSL_HAVE_SECP384r1
124 &ptls_openssl_secp384r1,
126 #ifdef PTLS_OPENSSL_HAVE_SECP521r1
127 &ptls_openssl_secp521r1
131 ckpair = app_cert_key_pair_get_if_valid (lctx->ckpair_index);
132 if (!ckpair || !ckpair->cert || !ckpair->key)
134 TLS_DBG (1, "tls cert and/or key not configured %d",
135 lctx->parent_app_wrk_index);
139 ptls_lctx_idx = picotls_listen_ctx_alloc ();
140 ptls_lctx = picotls_lctx_get (ptls_lctx_idx);
141 ptls_ctx = malloc (sizeof (ptls_context_t));
142 ptls_lctx->ptls_ctx = ptls_ctx;
144 memset (ptls_ctx, 0, sizeof (ptls_context_t));
145 ptls_ctx->update_open_count = NULL;
148 * Process certificate & private key.
150 load_bio_certificate_chain (ptls_ctx, (char *) ckpair->cert);
151 load_bio_private_key (ptls_ctx, (char *) ckpair->key);
153 /* setup protocol related functions */
154 ptls_ctx->key_exchanges = key_exchange;
155 ptls_ctx->random_bytes = ptls_openssl_random_bytes;
156 ptls_ctx->cipher_suites = ptls_vpp_crypto_cipher_suites;
157 ptls_ctx->get_time = &ptls_get_time;
159 lctx->tls_ssl_ctx = ptls_lctx_idx;
165 picotls_stop_listen (tls_ctx_t * lctx)
168 picotls_listen_ctx_t *ptls_lctx;
170 ptls_lctx_index = lctx->tls_ssl_ctx;
171 ptls_lctx = picotls_lctx_get (ptls_lctx_index);
173 picotls_listen_ctx_free (ptls_lctx);
179 picotls_handle_handshake_failure (tls_ctx_t * ctx)
181 session_free (session_get (ctx->c_s_index, ctx->c_thread_index));
182 ctx->no_app_session = 1;
183 ctx->c_s_index = SESSION_INVALID_INDEX;
184 tls_disconnect_transport (ctx);
188 picotls_confirm_app_close (tls_ctx_t * ctx)
190 tls_disconnect_transport (ctx);
191 session_transport_closed_notify (&ctx->connection);
195 picotls_transport_close (tls_ctx_t * ctx)
197 if (!picotls_handshake_is_over (ctx))
199 picotls_handle_handshake_failure (ctx);
202 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
203 ptls_free (ptls_ctx->tls);
204 session_transport_closed_notify (&ctx->connection);
209 picotls_app_close (tls_ctx_t * ctx)
211 session_t *app_session;
213 app_session = session_get_from_handle (ctx->app_session_handle);
214 if (!svm_fifo_max_dequeue_cons (app_session->tx_fifo))
215 picotls_confirm_app_close (ctx);
223 picotls_do_handshake (picotls_ctx_t * ptls_ctx, session_t * tls_session,
224 u8 * input, int input_len)
226 ptls_t *tls = ptls_ctx->tls;
228 int rv = PTLS_ERROR_IN_PROGRESS;
236 ptls_buffer_init (&buf, "", 0);
237 size_t consumed = input_len - off;
238 rv = ptls_handshake (tls, &buf, input + off, &consumed, NULL);
240 ptls_ctx->rx_offset += consumed;
241 if ((rv == 0 || rv == PTLS_ERROR_IN_PROGRESS) && buf.off != 0)
243 write = picotls_try_handshake_write (ptls_ctx, tls_session,
246 ptls_buffer_dispose (&buf);
248 while (rv == PTLS_ERROR_IN_PROGRESS && input_len != off);
250 while (rv == PTLS_ERROR_IN_PROGRESS);
256 picotls_ctx_read (tls_ctx_t * ctx, session_t * tls_session)
258 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
259 int from_tls_len = 0, off, crypto_len, ret;
260 u32 deq_max, deq_now;
262 ptls_buffer_t *buf = &ptls_ctx->read_buffer;
263 svm_fifo_t *tls_rx_fifo, *app_rx_fifo;
264 session_t *app_session;
266 tls_rx_fifo = tls_session->rx_fifo;
268 if (!picotls_handshake_is_over (ctx))
270 deq_max = svm_fifo_max_dequeue_cons (tls_rx_fifo);
274 vec_validate (ptls_ctx->rx_content, deq_max);
275 ptls_ctx->rx_offset = 0;
276 ptls_ctx->rx_len = 0;
278 off = svm_fifo_dequeue (tls_rx_fifo, deq_max, TLS_RX_LEN (ptls_ctx));
280 ptls_ctx->rx_len += off;
282 picotls_do_handshake (ptls_ctx, tls_session, TLS_RX_OFFSET (ptls_ctx),
284 if (picotls_handshake_is_over (ctx))
285 tls_notify_app_accept (ctx);
288 if (!TLS_RX_IS_LEFT (ptls_ctx))
292 app_session = session_get_from_handle (ctx->app_session_handle);
293 app_rx_fifo = app_session->rx_fifo;
295 if (TLS_READ_IS_LEFT (ptls_ctx))
298 ptls_buffer_init (buf, "", 0);
299 ptls_ctx->read_buffer_offset = 0;
301 if (!TLS_RX_IS_LEFT (ptls_ctx))
303 deq_max = svm_fifo_max_dequeue_cons (tls_rx_fifo);
307 deq_now = clib_min (deq_max, svm_fifo_max_read_chunk (tls_rx_fifo));
309 if (PREDICT_FALSE (deq_now < deq_max))
312 svm_fifo_dequeue (tls_rx_fifo, deq_max, TLS_RX_LEN (ptls_ctx));
314 ptls_ctx->rx_len += off;
319 ptls_receive (ptls_ctx->tls, buf, svm_fifo_head (tls_rx_fifo),
320 (size_t *) & deq_now);
321 svm_fifo_dequeue_drop (tls_rx_fifo, deq_now);
328 enq_max = svm_fifo_max_enqueue_prod (app_rx_fifo);
332 crypto_len = clib_min (enq_max, TLS_RX_LEFT_LEN (ptls_ctx));
337 size_t consumed = crypto_len - off;
339 ptls_receive (ptls_ctx->tls, buf,
340 TLS_RX_OFFSET (ptls_ctx), &consumed);
342 ptls_ctx->rx_offset += off;
344 while (ret == 0 && off < crypto_len);
349 svm_fifo_enqueue (app_rx_fifo, TLS_READ_LEFT_LEN (ptls_ctx),
350 TLS_READ_OFFSET (ptls_ctx));
353 tls_add_vpp_q_builtin_rx_evt (tls_session);
357 ptls_ctx->read_buffer_offset += off;
358 if (!TLS_RX_IS_LEFT (ptls_ctx))
360 ptls_ctx->rx_len = 0;
361 ptls_ctx->rx_offset = 0;
365 ptls_buffer_dispose (buf);
367 if (app_session->session_state >= SESSION_STATE_READY)
368 tls_notify_app_enqueue (ctx, app_session);
370 if (TLS_RX_IS_LEFT (ptls_ctx) || TLS_READ_IS_LEFT (ptls_ctx)
371 || svm_fifo_max_dequeue (tls_rx_fifo))
372 tls_add_vpp_q_builtin_rx_evt (tls_session);
378 picotls_content_process (picotls_ctx_t * ptls_ctx, svm_fifo_t * src_fifo,
379 svm_fifo_t * dst_fifo, int content_len,
380 int total_record_overhead, int is_no_copy)
382 ptls_buffer_t *buf = &ptls_ctx->write_buffer;
383 int total_length = content_len + total_record_overhead;
387 ptls_buffer_init (buf, svm_fifo_tail (dst_fifo), total_length);
388 ptls_send (ptls_ctx->tls, buf, svm_fifo_head (src_fifo), content_len);
390 assert (!buf->is_allocated);
391 assert (buf->base == svm_fifo_tail (dst_fifo));
393 svm_fifo_dequeue_drop (src_fifo, content_len);
394 svm_fifo_enqueue_nocopy (dst_fifo, buf->off);
395 to_dst_len = buf->off;
399 assert (!TLS_WRITE_IS_LEFT (ptls_ctx));
400 vec_validate (ptls_ctx->write_content, total_length);
401 ptls_buffer_init (buf, ptls_ctx->write_content, total_length);
403 ptls_send (ptls_ctx->tls, buf, svm_fifo_head (src_fifo), content_len);
404 svm_fifo_dequeue_drop (src_fifo, content_len);
406 to_dst_len = svm_fifo_enqueue (dst_fifo, buf->off, buf->base);
408 ptls_ctx->write_buffer_offset += to_dst_len;
413 picotls_ctx_write (tls_ctx_t * ctx, session_t * app_session,
414 transport_send_params_t * sp)
416 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
417 u32 deq_max, deq_now;
418 u32 enq_max, enq_now;
419 int from_app_len = 0, to_tls_len = 0, is_nocopy = 0;
420 svm_fifo_t *tls_tx_fifo, *app_tx_fifo;
421 session_t *tls_session;
423 int record_overhead = ptls_get_record_overhead (ptls_ctx->tls);
424 int num_records, total_overhead;
426 tls_session = session_get_from_handle (ctx->tls_session_handle);
427 tls_tx_fifo = tls_session->tx_fifo;
428 app_tx_fifo = app_session->tx_fifo;
430 if (PREDICT_FALSE (TLS_WRITE_IS_LEFT (ptls_ctx)))
432 enq_max = svm_fifo_max_enqueue_prod (tls_tx_fifo);
433 int to_write = clib_min (enq_max,
434 ptls_ctx->write_buffer.off -
435 ptls_ctx->write_buffer_offset);
437 svm_fifo_enqueue (tls_tx_fifo, to_write, TLS_WRITE_OFFSET (ptls_ctx));
440 app_session->flags |= SESSION_F_CUSTOM_TX;
443 ptls_ctx->write_buffer_offset += to_tls_len;
445 if (TLS_WRITE_IS_LEFT (ptls_ctx))
447 app_session->flags |= SESSION_F_CUSTOM_TX;
452 ptls_buffer_init (&ptls_ctx->write_buffer, "", 0);
453 ptls_ctx->write_buffer_offset = 0;
458 deq_max = svm_fifo_max_dequeue_cons (app_tx_fifo);
462 deq_now = clib_min (deq_max, sp->max_burst_size);
463 deq_now = clib_min (deq_now, svm_fifo_max_read_chunk (app_tx_fifo));
465 enq_max = svm_fifo_max_enqueue_prod (tls_tx_fifo);
466 /** There is no engough enqueue space for one record **/
467 if (enq_max <= record_overhead)
469 app_session->flags |= SESSION_F_CUSTOM_TX;
473 enq_now = clib_min (enq_max, svm_fifo_max_write_chunk (tls_tx_fifo));
475 /** Allowed to execute no-copy crypto operation **/
476 if (enq_now > record_overhead)
479 from_app_len = clib_min (deq_now, enq_now);
481 ceil ((f64) from_app_len / PTLS_MAX_PLAINTEXT_RECORD_SIZE);
482 total_overhead = num_records * record_overhead;
483 if (from_app_len + total_overhead > enq_now)
484 from_app_len = enq_now - total_overhead;
488 from_app_len = clib_min (deq_now, enq_max);
490 ceil ((f64) from_app_len / PTLS_MAX_PLAINTEXT_RECORD_SIZE);
491 total_overhead = num_records * record_overhead;
492 if (from_app_len + total_overhead > enq_max)
493 from_app_len = enq_max - total_overhead;
497 picotls_content_process (ptls_ctx, app_tx_fifo, tls_tx_fifo,
498 from_app_len, total_overhead, is_nocopy);
499 if (!TLS_WRITE_IS_LEFT (ptls_ctx))
501 ptls_ctx->write_buffer_offset = 0;
502 ptls_buffer_init (&ptls_ctx->write_buffer, "", 0);
505 if (svm_fifo_needs_deq_ntf (app_tx_fifo, from_app_len))
506 session_dequeue_notify (app_session);
509 tls_add_vpp_q_tx_evt (tls_session);
511 if (from_app_len < deq_max || TLS_WRITE_IS_LEFT (ptls_ctx))
512 app_session->flags |= SESSION_F_CUSTOM_TX;
515 picotls_app_close (ctx);
521 picotls_ctx_init_server (tls_ctx_t * ctx)
523 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
524 u32 ptls_lctx_idx = ctx->tls_ssl_ctx;
525 picotls_listen_ctx_t *ptls_lctx;
527 ptls_lctx = picotls_lctx_get (ptls_lctx_idx);
528 ptls_ctx->tls = ptls_new (ptls_lctx->ptls_ctx, 1);
529 if (ptls_ctx->tls == NULL)
531 TLS_DBG (1, "Failed to initialize ptls_ssl structure");
535 ptls_ctx->rx_len = 0;
536 ptls_ctx->rx_offset = 0;
538 ptls_ctx->write_buffer_offset = 0;
543 picotls_ctx_get_w_thread (u32 ctx_index, u8 thread_index)
546 ctx = pool_elt_at_index (picotls_main.ctx_pool[thread_index], ctx_index);
550 const static tls_engine_vft_t picotls_engine = {
551 .ctx_alloc = picotls_ctx_alloc,
552 .ctx_free = picotls_ctx_free,
553 .ctx_get = picotls_ctx_get,
554 .ctx_get_w_thread = picotls_ctx_get_w_thread,
555 .ctx_handshake_is_over = picotls_handshake_is_over,
556 .ctx_start_listen = picotls_start_listen,
557 .ctx_stop_listen = picotls_stop_listen,
558 .ctx_init_server = picotls_ctx_init_server,
559 .ctx_read = picotls_ctx_read,
560 .ctx_write = picotls_ctx_write,
561 .ctx_transport_close = picotls_transport_close,
562 .ctx_app_close = picotls_app_close,
565 static clib_error_t *
566 tls_picotls_init (vlib_main_t * vm)
568 vlib_thread_main_t *vtm = vlib_get_thread_main ();
569 picotls_main_t *pm = &picotls_main;
570 clib_error_t *error = 0;
573 num_threads = 1 + vtm->n_threads;
575 vec_validate (pm->ctx_pool, num_threads - 1);
577 tls_register_engine (&picotls_engine, CRYPTO_ENGINE_PICOTLS);
583 VLIB_INIT_FUNCTION (tls_picotls_init) = {
584 .runs_after = VLIB_INITS ("tls_init"),
589 VLIB_PLUGIN_REGISTER () = {
590 .version = VPP_BUILD_VER,
591 .description = "Transport Layer Security (TLS) Engine, Picotls Based",
596 * fd.io coding-style-patch-verification: ON
599 * eval: (c-set-style "gnu")