4 #include "tls_picotls.h"
6 picotls_main_t picotls_main;
8 #define MAX_QUEUE 12000
9 #define PTLS_MAX_PLAINTEXT_RECORD_SIZE 16384
12 picotls_ctx_alloc (void)
14 u8 thread_id = vlib_get_thread_index ();
15 picotls_main_t *pm = &picotls_main;
18 pool_get (pm->ctx_pool[thread_id], ctx);
20 *ctx = clib_mem_alloc (sizeof (picotls_ctx_t));
22 clib_memset (*ctx, 0, sizeof (picotls_ctx_t));
23 (*ctx)->ctx.c_thread_index = thread_id;
24 (*ctx)->ctx.tls_ctx_engine = CRYPTO_ENGINE_PICOTLS;
25 (*ctx)->ctx.app_session_handle = SESSION_INVALID_HANDLE;
26 (*ctx)->ptls_ctx_idx = ctx - pm->ctx_pool[thread_id];
27 return (*ctx)->ptls_ctx_idx;
31 picotls_ctx_free (tls_ctx_t * ctx)
33 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
34 free (ptls_ctx->rx_content);
35 pool_put_index (picotls_main.ctx_pool[ctx->c_thread_index],
36 ptls_ctx->ptls_ctx_idx);
40 picotls_listen_ctx_alloc (void)
42 picotls_main_t *pm = &picotls_main;
43 picotls_listen_ctx_t *ptls_lctx;
45 pool_get (pm->lctx_pool, ptls_lctx);
47 clib_memset (ptls_lctx, 0, sizeof (picotls_listen_ctx_t));
48 ptls_lctx->ptls_lctx_index = ptls_lctx - pm->lctx_pool;
49 return ptls_lctx->ptls_lctx_index;
53 picotls_listen_ctx_free (picotls_listen_ctx_t * lctx)
55 pool_put_index (picotls_main.lctx_pool, lctx->ptls_lctx_index);
59 picotls_ctx_get (u32 ctx_index)
63 pool_elt_at_index (picotls_main.ctx_pool[vlib_get_thread_index ()],
68 picotls_listen_ctx_t *
69 picotls_lctx_get (u32 lctx_index)
71 return pool_elt_at_index (picotls_main.lctx_pool, lctx_index);
75 picotls_handshake_is_over (tls_ctx_t * ctx)
77 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
78 assert (ptls_ctx->tls);
79 return ptls_handshake_is_complete (ptls_ctx->tls);
83 picotls_try_handshake_write (picotls_ctx_t * ptls_ctx,
84 session_t * tls_session, ptls_buffer_t * buf)
93 f = tls_session->tx_fifo;
95 enq_max = svm_fifo_max_enqueue_prod (f);
99 enq_now = clib_min (svm_fifo_max_write_chunk (f), enq_max);
100 enq_now = clib_min (enq_now, buf_left);
101 write = svm_fifo_enqueue (f, enq_now, buf->base);
103 tls_add_vpp_q_tx_evt (tls_session);
108 picotls_start_listen (tls_ctx_t * lctx)
110 picotls_listen_ctx_t *ptls_lctx;
111 ptls_context_t *ptls_ctx;
113 app_cert_key_pair_t *ckpair;
114 static ptls_key_exchange_algorithm_t *key_exchange[] = {
115 #ifdef PTLS_OPENSSL_HAVE_X25519
116 &ptls_openssl_x25519,
118 #ifdef PTLS_OPENSSL_HAVE_SECP256r1
119 &ptls_openssl_secp256r1,
121 #ifdef PTLS_OPENSSL_HAVE_SECP384r1
122 &ptls_openssl_secp384r1,
124 #ifdef PTLS_OPENSSL_HAVE_SECP521r1
125 &ptls_openssl_secp521r1
129 ckpair = app_cert_key_pair_get_if_valid (lctx->ckpair_index);
130 if (!ckpair || !ckpair->cert || !ckpair->key)
132 TLS_DBG (1, "tls cert and/or key not configured %d",
133 ctx->parent_app_wrk_index);
137 ptls_lctx_idx = picotls_listen_ctx_alloc ();
138 ptls_lctx = picotls_lctx_get (ptls_lctx_idx);
139 ptls_ctx = malloc (sizeof (ptls_context_t));
140 ptls_lctx->ptls_ctx = ptls_ctx;
142 memset (ptls_ctx, 0, sizeof (ptls_context_t));
143 ptls_ctx->update_open_count = NULL;
146 * Process certificate & private key.
148 load_bio_certificate_chain (ptls_ctx, (char *) ckpair->cert);
149 load_bio_private_key (ptls_ctx, (char *) ckpair->key);
151 /* setup protocol related functions */
152 ptls_ctx->key_exchanges = key_exchange;
153 ptls_ctx->random_bytes = ptls_openssl_random_bytes;
154 ptls_ctx->cipher_suites = ptls_openssl_cipher_suites;
155 ptls_ctx->get_time = &ptls_get_time;
157 lctx->tls_ssl_ctx = ptls_lctx_idx;
163 picotls_stop_listen (tls_ctx_t * lctx)
166 picotls_listen_ctx_t *ptls_lctx;
168 ptls_lctx_index = lctx->tls_ssl_ctx;
169 ptls_lctx = picotls_lctx_get (ptls_lctx_index);
171 picotls_listen_ctx_free (ptls_lctx);
177 picotls_handle_handshake_failure (tls_ctx_t * ctx)
179 session_free (session_get (ctx->c_s_index, ctx->c_thread_index));
180 ctx->no_app_session = 1;
181 ctx->c_s_index = SESSION_INVALID_INDEX;
182 tls_disconnect_transport (ctx);
186 picotls_confirm_app_close (tls_ctx_t * ctx)
188 tls_disconnect_transport (ctx);
189 session_transport_closed_notify (&ctx->connection);
193 picotls_transport_close (tls_ctx_t * ctx)
195 if (!picotls_handshake_is_over (ctx))
197 picotls_handle_handshake_failure (ctx);
200 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
201 ptls_free (ptls_ctx->tls);
202 session_transport_closed_notify (&ctx->connection);
207 picotls_app_close (tls_ctx_t * ctx)
209 session_t *app_session;
211 app_session = session_get_from_handle (ctx->app_session_handle);
212 if (!svm_fifo_max_dequeue_cons (app_session->tx_fifo))
213 picotls_confirm_app_close (ctx);
221 picotls_do_handshake (picotls_ctx_t * ptls_ctx, session_t * tls_session,
222 u8 * input, int input_len)
224 ptls_t *tls = ptls_ctx->tls;
226 int rv = PTLS_ERROR_IN_PROGRESS;
234 ptls_buffer_init (&buf, "", 0);
235 size_t consumed = input_len - off;
236 rv = ptls_handshake (tls, &buf, input + off, &consumed, NULL);
238 if ((rv == 0 || rv == PTLS_ERROR_IN_PROGRESS) && buf.off != 0)
240 write = picotls_try_handshake_write (ptls_ctx, tls_session,
243 ptls_buffer_dispose (&buf);
245 while (rv == PTLS_ERROR_IN_PROGRESS && input_len != off);
247 while (rv == PTLS_ERROR_IN_PROGRESS);
253 picotls_ctx_read (tls_ctx_t * ctx, session_t * tls_session)
255 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
257 int to_read, from_tls_len = 0, to_app_len = 0, crypto_len, ret;
258 u32 deq_max, deq_now;
259 u32 enq_max, enq_now;
260 ptls_buffer_t _buf, *buf = &_buf;
261 svm_fifo_t *tls_rx_fifo, *app_rx_fifo;
262 session_t *app_session;
264 tls_rx_fifo = tls_session->rx_fifo;
266 if (!picotls_handshake_is_over (ctx))
268 deq_max = svm_fifo_max_dequeue_cons (tls_rx_fifo);
269 input = clib_mem_alloc (deq_max);
270 memset (input, 0, deq_max);
272 deq_now = clib_min (deq_max, svm_fifo_max_read_chunk (tls_rx_fifo));
276 from_tls_len += svm_fifo_dequeue (tls_rx_fifo, deq_now, input);
277 if (from_tls_len <= 0)
279 tls_add_vpp_q_builtin_rx_evt (tls_session);
282 if (from_tls_len < deq_max)
284 deq_now = clib_min (svm_fifo_max_read_chunk (tls_rx_fifo),
285 deq_max - from_tls_len);
286 from_tls_len += svm_fifo_dequeue (tls_rx_fifo, deq_now,
287 input + from_tls_len);
289 picotls_do_handshake (ptls_ctx, tls_session, input, from_tls_len);
290 if (picotls_handshake_is_over (ctx))
291 tls_notify_app_accept (ctx);
294 clib_mem_free (input);
298 app_session = session_get_from_handle (ctx->app_session_handle);
299 app_rx_fifo = app_session->rx_fifo;
301 ptls_buffer_init (buf, "", 0);
303 deq_max = svm_fifo_max_dequeue_cons (tls_rx_fifo);
305 if (!deq_max || deq_max > MAX_QUEUE - ptls_ctx->rx_len)
310 deq_now = clib_min (deq_max, svm_fifo_max_read_chunk (tls_rx_fifo));
313 svm_fifo_dequeue (tls_rx_fifo, deq_now,
314 ptls_ctx->rx_content + ptls_ctx->rx_len);
315 if (from_tls_len <= 0)
317 tls_add_vpp_q_builtin_rx_evt (tls_session);
320 if (from_tls_len < deq_max)
323 clib_min (svm_fifo_max_read_chunk (tls_rx_fifo),
324 deq_max - from_tls_len);
326 svm_fifo_dequeue (tls_rx_fifo, deq_now,
327 ptls_ctx->rx_content + ptls_ctx->rx_len +
330 ptls_ctx->rx_len += from_tls_len;
333 if (ptls_ctx->rx_len <= 0 || ptls_ctx->rx_offset == ptls_ctx->rx_len)
335 if (ptls_ctx->rx_len != 0)
337 ptls_ctx->rx_len = 0;
338 ptls_ctx->rx_offset = 0;
339 tls_add_vpp_q_builtin_rx_evt (tls_session);
344 enq_max = svm_fifo_max_enqueue_prod (app_rx_fifo);
347 tls_add_vpp_q_builtin_rx_evt (tls_session);
351 crypto_len = clib_min (enq_max, ptls_ctx->rx_len - ptls_ctx->rx_offset);
352 crypto_len = clib_min (crypto_len, from_tls_len);
357 size_t consumed = crypto_len - off;
359 ptls_receive (ptls_ctx->tls, buf,
360 ptls_ctx->rx_content + ptls_ctx->rx_offset + off,
364 while (ret == 0 && off < crypto_len);
368 ptls_ctx->rx_offset += crypto_len;
370 to_read = clib_min (enq_max, buf->off);
371 enq_now = clib_min (to_read, svm_fifo_max_write_chunk (app_rx_fifo));
372 to_app_len = svm_fifo_enqueue (app_rx_fifo, enq_now, buf->base);
373 if (to_app_len < buf->off)
376 clib_min (svm_fifo_max_write_chunk (app_rx_fifo),
377 buf->off - to_app_len);
379 svm_fifo_enqueue (app_rx_fifo, enq_now, buf->base + to_app_len);
384 ptls_buffer_dispose (buf);
387 picotls_confirm_app_close (ctx);
391 tls_notify_app_enqueue (ctx, app_session);
396 picotls_content_process (ptls_t * tls, svm_fifo_t * src_fifo,
397 svm_fifo_t * dst_fifo, int content_len,
398 int total_record_overhead, int is_no_copy)
400 ptls_buffer_t _buf, *buf = &_buf;
401 int total_length = content_len + total_record_overhead;
405 ptls_buffer_init (buf, svm_fifo_tail (dst_fifo), total_length);
406 ptls_send (tls, buf, svm_fifo_head (src_fifo), content_len);
408 assert (!buf->is_allocated);
409 assert (buf->base == svm_fifo_tail (dst_fifo));
411 svm_fifo_dequeue_drop (src_fifo, content_len);
412 svm_fifo_enqueue_nocopy (dst_fifo, buf->off);
413 to_dst_len = buf->off;
417 uint8_t *buf_content = malloc (total_length);
418 ptls_buffer_init (buf, buf_content, total_length);
420 ptls_send (tls, buf, svm_fifo_head (src_fifo), content_len);
421 svm_fifo_dequeue_drop (src_fifo, content_len);
423 to_dst_len = svm_fifo_enqueue (dst_fifo, buf->off, buf->base);
424 if (to_dst_len < buf->off)
426 svm_fifo_enqueue (dst_fifo, buf->off - to_dst_len,
427 buf->base + to_dst_len);
428 ptls_buffer_dispose (buf);
434 picotls_ctx_write (tls_ctx_t * ctx, session_t * app_session)
436 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
437 u32 deq_max, deq_now;
438 u32 enq_max, enq_now;
439 int from_app_len = 0, to_tls_len = 0, is_nocopy = 0;
440 svm_fifo_t *tls_tx_fifo, *app_tx_fifo;
441 session_t *tls_session;
443 int record_overhead = ptls_get_record_overhead (ptls_ctx->tls);
444 int num_records, total_overhead;
446 tls_session = session_get_from_handle (ctx->tls_session_handle);
447 tls_tx_fifo = tls_session->tx_fifo;
448 app_tx_fifo = app_session->tx_fifo;
450 deq_max = svm_fifo_max_dequeue_cons (app_tx_fifo);
453 deq_now = clib_min (deq_max, svm_fifo_max_read_chunk (app_tx_fifo));
455 enq_max = svm_fifo_max_enqueue_prod (tls_tx_fifo);
457 /** There is no engough enqueue space for one record **/
458 if (enq_max < record_overhead)
460 tls_add_vpp_q_builtin_tx_evt (app_session);
464 enq_now = clib_min (enq_max, svm_fifo_max_write_chunk (tls_tx_fifo));
466 /** Allowed to execute no-copy crypto operation **/
467 if (enq_now > record_overhead)
470 from_app_len = clib_min (deq_now, enq_now);
472 ceil ((f64) from_app_len / PTLS_MAX_PLAINTEXT_RECORD_SIZE);
473 total_overhead = num_records * record_overhead;
474 if (from_app_len + total_overhead > enq_now)
475 from_app_len = enq_now - total_overhead;
481 from_app_len = clib_min (deq_now, enq_max);
483 ceil ((f64) from_app_len / PTLS_MAX_PLAINTEXT_RECORD_SIZE);
484 total_overhead = num_records * record_overhead;
485 if (from_app_len + total_overhead > enq_max)
486 from_app_len = enq_max - total_overhead;
491 picotls_content_process (ptls_ctx->tls, app_tx_fifo, tls_tx_fifo,
492 from_app_len, total_overhead, is_nocopy);
494 if (svm_fifo_needs_deq_ntf (app_tx_fifo, from_app_len))
495 session_dequeue_notify (app_session);
498 tls_add_vpp_q_tx_evt (tls_session);
499 tls_add_vpp_q_builtin_tx_evt (app_session);
502 picotls_app_close (ctx);
508 picotls_ctx_init_server (tls_ctx_t * ctx)
510 picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
511 u32 ptls_lctx_idx = ctx->tls_ssl_ctx;
512 picotls_listen_ctx_t *ptls_lctx;
514 ptls_lctx = picotls_lctx_get (ptls_lctx_idx);
515 ptls_ctx->tls = ptls_new (ptls_lctx->ptls_ctx, 1);
516 if (ptls_ctx->tls == NULL)
518 TLS_DBG (1, "Failed to initialize ptls_ssl structure");
522 ptls_ctx->rx_len = 0;
523 ptls_ctx->rx_offset = 0;
525 ptls_ctx->rx_content = malloc (MAX_QUEUE);
531 picotls_ctx_get_w_thread (u32 ctx_index, u8 thread_index)
534 ctx = pool_elt_at_index (picotls_main.ctx_pool[thread_index], ctx_index);
538 const static tls_engine_vft_t picotls_engine = {
539 .ctx_alloc = picotls_ctx_alloc,
540 .ctx_free = picotls_ctx_free,
541 .ctx_get = picotls_ctx_get,
542 .ctx_get_w_thread = picotls_ctx_get_w_thread,
543 .ctx_handshake_is_over = picotls_handshake_is_over,
544 .ctx_start_listen = picotls_start_listen,
545 .ctx_stop_listen = picotls_stop_listen,
546 .ctx_init_server = picotls_ctx_init_server,
547 .ctx_read = picotls_ctx_read,
548 .ctx_write = picotls_ctx_write,
549 .ctx_transport_close = picotls_transport_close,
550 .ctx_app_close = picotls_app_close,
553 static clib_error_t *
554 tls_picotls_init (vlib_main_t * vm)
556 vlib_thread_main_t *vtm = vlib_get_thread_main ();
557 picotls_main_t *pm = &picotls_main;
558 clib_error_t *error = 0;
561 num_threads = 1 + vtm->n_threads;
563 vec_validate (pm->ctx_pool, num_threads - 1);
565 tls_register_engine (&picotls_engine, CRYPTO_ENGINE_PICOTLS);
571 VLIB_INIT_FUNCTION (tls_picotls_init) = {
572 .runs_after = VLIB_INITS ("tls_init"),
577 VLIB_PLUGIN_REGISTER () = {
578 .version = VPP_BUILD_VER,
579 .description = "Transport Layer Security (TLS) Engine, Picotls Based",
584 * fd.io coding-style-patch-verification: ON
587 * eval: (c-set-style "gnu")