2 * Copyright (c) 2018-2019 Cisco and/or its affiliates.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at:
7 * http://www.apache.org/licenses/LICENSE-2.0
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
16 #include <vnet/session/application_interface.h>
17 #include <vnet/session/application.h>
18 #include <vnet/session/session.h>
19 #include <vppinfra/lock.h>
21 #ifndef SRC_VNET_TLS_TLS_H_
22 #define SRC_VNET_TLS_TLS_H_
25 #define TLS_DEBUG_LEVEL_CLIENT 0
26 #define TLS_DEBUG_LEVEL_SERVER 0
28 #define TLS_CHUNK_SIZE (1 << 14)
29 #define TLS_CA_CERT_PATH "/etc/ssl/certs/ca-certificates.crt"
32 #define TLS_DBG(_lvl, _fmt, _args...) \
33 if (_lvl <= TLS_DEBUG) \
34 clib_warning (_fmt, ##_args)
36 #define TLS_DBG(_lvl, _fmt, _args...)
39 typedef struct tls_cxt_id_
41 session_handle_t app_session_handle;
42 session_handle_t tls_session_handle;
44 u32 parent_app_wrk_index;
48 u32 listener_ctx_index;
49 u32 parent_app_api_ctx;
55 STATIC_ASSERT (sizeof (tls_ctx_id_t) <= TRANSPORT_CONN_ID_LEN,
56 "ctx id must be less than TRANSPORT_CONN_ID_LEN");
58 #define foreach_tls_conn_flags \
59 _ (HO_DONE, "ho-done") \
60 _ (PASSIVE_CLOSE, "passive-close") \
61 _ (APP_CLOSED, "app-closed") \
62 _ (MIGRATED, "migrated") \
63 _ (NO_APP_SESSION, "no-app-session") \
64 _ (RESUME, "resume") \
65 _ (HS_DONE, "handshake-done")
67 typedef enum tls_conn_flags_bit_
69 #define _(sym, str) TLS_CONN_F_BIT_##sym,
70 foreach_tls_conn_flags
72 } tls_conn_flags_bit_t;
74 typedef enum tls_conn_flags_
76 #define _(sym, str) TLS_CONN_F_##sym = 1 << TLS_CONN_F_BIT_##sym,
77 foreach_tls_conn_flags
79 } __clib_packed tls_conn_flags_t;
81 typedef struct tls_ctx_
85 transport_connection_t connection;
86 tls_ctx_id_t c_tls_ctx_id;
88 #define parent_app_wrk_index c_tls_ctx_id.parent_app_wrk_index
89 #define app_session_handle c_tls_ctx_id.app_session_handle
90 #define tls_session_handle c_tls_ctx_id.tls_session_handle
91 #define listener_ctx_index c_tls_ctx_id.listener_ctx_index
92 #define tcp_is_ip4 c_tls_ctx_id.tcp_is_ip4
93 #define tls_ctx_engine c_tls_ctx_id.tls_engine_id
94 #define tls_ssl_ctx c_tls_ctx_id.ssl_ctx
95 #define tls_ctx_handle c_c_index
96 /* Temporary storage for session open opaque. Overwritten once
97 * underlying tcp connection is established */
98 #define parent_app_api_context c_tls_ctx_id.parent_app_api_ctx
99 #define migration_ctx c_tls_ctx_id.migrate_ctx
101 tls_conn_flags_t flags;
105 transport_proto_t tls_type;
108 typedef struct tls_main_
111 tls_ctx_t *listener_ctx_pool;
112 tls_ctx_t *half_open_ctx_pool;
113 u32 *postponed_ho_free;
121 u8 use_test_cert_in_ca;
128 typedef struct tls_engine_vft_
130 u32 (*ctx_alloc) (void);
131 u32 (*ctx_alloc_w_thread) (u32 thread_index);
132 void (*ctx_free) (tls_ctx_t * ctx);
133 void *(*ctx_detach) (tls_ctx_t *ctx);
134 u32 (*ctx_attach) (u32 thread_index, void *ctx);
135 tls_ctx_t *(*ctx_get) (u32 ctx_index);
136 tls_ctx_t *(*ctx_get_w_thread) (u32 ctx_index, u8 thread_index);
137 int (*ctx_init_client) (tls_ctx_t * ctx);
138 int (*ctx_init_server) (tls_ctx_t * ctx);
139 int (*ctx_read) (tls_ctx_t * ctx, session_t * tls_session);
140 int (*ctx_write) (tls_ctx_t * ctx, session_t * app_session,
141 transport_send_params_t * sp);
142 u8 (*ctx_handshake_is_over) (tls_ctx_t * ctx);
143 int (*ctx_start_listen) (tls_ctx_t * ctx);
144 int (*ctx_stop_listen) (tls_ctx_t * ctx);
145 int (*ctx_transport_close) (tls_ctx_t * ctx);
146 int (*ctx_transport_reset) (tls_ctx_t *ctx);
147 int (*ctx_app_close) (tls_ctx_t * ctx);
148 int (*ctx_reinit_cachain) (void);
151 tls_main_t *vnet_tls_get_main (void);
152 void tls_register_engine (const tls_engine_vft_t * vft,
153 crypto_engine_type_t type);
154 int tls_add_vpp_q_rx_evt (session_t * s);
155 int tls_add_vpp_q_tx_evt (session_t * s);
156 int tls_add_vpp_q_builtin_tx_evt (session_t * s);
157 int tls_add_vpp_q_builtin_rx_evt (session_t * s);
158 int tls_notify_app_accept (tls_ctx_t * ctx);
159 int tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err);
160 void tls_notify_app_enqueue (tls_ctx_t * ctx, session_t * app_session);
161 void tls_notify_app_io_error (tls_ctx_t *ctx);
162 void tls_disconnect_transport (tls_ctx_t * ctx);
163 int tls_reinit_ca_chain (crypto_engine_type_t tls_engine_id);
165 void tls_add_postponed_ho_cleanups (u32 ho_index);
166 void tls_flush_postponed_ho_cleanups ();
168 #endif /* SRC_VNET_TLS_TLS_H_ */
171 * fd.io coding-style-patch-verification: ON
174 * eval: (c-set-style "gnu")