tls: limit openssl engine max read burst

[vpp.git] / src / plugins / tlsopenssl / tls_openssl.c

diff --git a/src/plugins/tlsopenssl/tls_openssl.c b/src/plugins/tlsopenssl/tls_openssl.c
index 75494aa..a3e93e1 100644 (file)
--- a/src/plugins/tlsopenssl/tls_openssl.c
+++ b/src/plugins/tlsopenssl/tls_openssl.c
@@ -28,6 +28,7 @@
 #include <tlsopenssl/tls_openssl.h>
 #include <tlsopenssl/tls_bios.h>
 #include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
 
 #define MAX_CRYPTO_LEN 64
 
@@ -39,7 +40,8 @@ openssl_ctx_alloc_w_thread (u32 thread_index)
   openssl_main_t *om = &openssl_main;
   openssl_ctx_t **ctx;
 
-  pool_get (om->ctx_pool[thread_index], ctx);
+  pool_get_aligned_safe (om->ctx_pool[thread_index], ctx, 0);
+
   if (!(*ctx))
     *ctx = clib_mem_alloc (sizeof (openssl_ctx_t));
 
@@ -98,7 +100,7 @@ openssl_ctx_attach (u32 thread_index, void *ctx_ptr)
   session_handle_t sh;
   openssl_ctx_t **oc;
 
-  pool_get (om->ctx_pool[thread_index], oc);
+  pool_get_aligned_safe (om->ctx_pool[thread_index], oc, 0);
   /* Free the old instance instead of looking for an empty spot */
   if (*oc)
     clib_mem_free (*oc);
@@ -161,7 +163,7 @@ openssl_lctx_get (u32 lctx_index)
     return -1;
 
 static int
-openssl_read_from_ssl_into_fifo (svm_fifo_t * f, SSL * ssl)
+openssl_read_from_ssl_into_fifo (svm_fifo_t *f, SSL *ssl, u32 max_len)
 {
   int read, rv, n_fs, i;
   const int n_segs = 2;
@@ -172,6 +174,7 @@ openssl_read_from_ssl_into_fifo (svm_fifo_t * f, SSL * ssl)
   if (!max_enq)
     return 0;
 
+  max_enq = clib_min (max_len, max_enq);
   n_fs = svm_fifo_provision_chunks (f, fs, n_segs, max_enq);
   if (n_fs < 0)
     return 0;
@@ -184,18 +187,20 @@ openssl_read_from_ssl_into_fifo (svm_fifo_t * f, SSL * ssl)
       return 0;
     }
 
-  for (i = 1; i < n_fs; i++)
+  if (read == (int) fs[0].len)
     {
-      rv = SSL_read (ssl, fs[i].data, fs[i].len);
-      read += rv > 0 ? rv : 0;
-
-      if (rv < (int) fs[i].len)
+      for (i = 1; i < n_fs; i++)
        {
-         ossl_check_err_is_fatal (ssl, rv);
-         break;
+         rv = SSL_read (ssl, fs[i].data, fs[i].len);
+         read += rv > 0 ? rv : 0;
+
+         if (rv < (int) fs[i].len)
+           {
+             ossl_check_err_is_fatal (ssl, rv);
+             break;
+           }
        }
     }
-
   svm_fifo_enqueue_nocopy (f, read);
 
   return read;
@@ -269,10 +274,10 @@ openssl_handle_handshake_failure (tls_ctx_t * ctx)
       if (app_session)
        {
          session_free (app_session);
-         ctx->no_app_session = 1;
          ctx->c_s_index = SESSION_INVALID_INDEX;
          tls_disconnect_transport (ctx);
        }
+      ctx->no_app_session = 1;
     }
   else
     {
@@ -350,7 +355,11 @@ openssl_ctx_handshake_rx (tls_ctx_t * ctx, session_t * tls_session)
              return -1;
            }
        }
-      tls_notify_app_connected (ctx, SESSION_E_NONE);
+      if (tls_notify_app_connected (ctx, SESSION_E_NONE))
+       {
+         tls_disconnect_transport (ctx);
+         return -1;
+       }
     }
   else
     {
@@ -525,20 +534,24 @@ static inline int
 openssl_ctx_read_tls (tls_ctx_t *ctx, session_t *tls_session)
 {
   openssl_ctx_t *oc = (openssl_ctx_t *) ctx;
+  const u32 max_len = 128 << 10;
   session_t *app_session;
-  int read;
   svm_fifo_t *f;
+  int read;
 
   if (PREDICT_FALSE (SSL_in_init (oc->ssl)))
     {
       if (openssl_ctx_handshake_rx (ctx, tls_session) < 0)
        return 0;
+
+      /* Application might force a session pool realloc on accept */
+      tls_session = session_get_from_handle (ctx->tls_session_handle);
     }
 
   app_session = session_get_from_handle (ctx->app_session_handle);
   f = app_session->rx_fifo;
 
-  read = openssl_read_from_ssl_into_fifo (f, oc->ssl);
+  read = openssl_read_from_ssl_into_fifo (f, oc->ssl, max_len);
 
   /* Unrecoverable protocol error. Reset connection */
   if (PREDICT_FALSE (read < 0))
@@ -629,13 +642,17 @@ openssl_ctx_read (tls_ctx_t *ctx, session_t *ts)
 }
 
 static int
-openssl_set_ckpair (SSL *ssl_connection, u32 ckpair_index)
+openssl_set_ckpair (SSL *ssl, u32 ckpair_index)
 {
   app_cert_key_pair_t *ckpair;
   BIO *cert_bio;
   EVP_PKEY *pkey;
   X509 *srvcert;
 
+  /* Configure a ckpair index only if non-default/test provided */
+  if (ckpair_index == 0)
+    return 0;
+
   ckpair = app_cert_key_pair_get_if_valid (ckpair_index);
   if (!ckpair)
     return -1;
@@ -656,7 +673,7 @@ openssl_set_ckpair (SSL *ssl_connection, u32 ckpair_index)
       clib_warning ("unable to parse certificate");
       return -1;
     }
-  SSL_use_certificate (ssl_connection, srvcert);
+  SSL_use_certificate (ssl, srvcert);
   BIO_free (cert_bio);
 
   cert_bio = BIO_new (BIO_s_mem ());
@@ -667,10 +684,42 @@ openssl_set_ckpair (SSL *ssl_connection, u32 ckpair_index)
       clib_warning ("unable to parse pkey");
       return -1;
     }
-  SSL_use_PrivateKey (ssl_connection, pkey);
+  SSL_use_PrivateKey (ssl, pkey);
   BIO_free (cert_bio);
   TLS_DBG (1, "TLS client using ckpair index: %d", ckpair_index);
+  return 0;
+}
+
+static int
+openssl_client_init_verify (SSL *ssl, const char *srv_hostname,
+                           int set_hostname_verification,
+                           int set_hostname_strict_check)
+{
+  if (set_hostname_verification)
+    {
+      X509_VERIFY_PARAM *param = SSL_get0_param (ssl);
+      if (!param)
+       {
+         TLS_DBG (1, "Couldn't fetch SSL param");
+         return -1;
+       }
 
+      if (set_hostname_strict_check)
+       X509_VERIFY_PARAM_set_hostflags (param,
+                                        X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+
+      if (!X509_VERIFY_PARAM_set1_host (param, srv_hostname, 0))
+       {
+         TLS_DBG (1, "Couldn't set hostname for verification");
+         return -1;
+       }
+      SSL_set_verify (ssl, SSL_VERIFY_PEER, 0);
+    }
+  if (!SSL_set_tlsext_host_name (ssl, srv_hostname))
+    {
+      TLS_DBG (1, "Couldn't set hostname");
+      return -1;
+    }
   return 0;
 }
 
@@ -735,10 +784,12 @@ openssl_ctx_init_client (tls_ctx_t * ctx)
   SSL_set_bio (oc->ssl, oc->wbio, oc->rbio);
   SSL_set_connect_state (oc->ssl);
 
-  rv = SSL_set_tlsext_host_name (oc->ssl, ctx->srv_hostname);
-  if (rv != 1)
+  /* Hostname validation and strict check by name are disabled by default */
+  rv = openssl_client_init_verify (oc->ssl, (const char *) ctx->srv_hostname,
+                                  0, 0);
+  if (rv)
     {
-      TLS_DBG (1, "Couldn't set hostname");
+      TLS_DBG (1, "ERROR:verify init failed:%d", rv);
       return -1;
     }
   if (openssl_set_ckpair (oc->ssl, ctx->ckpair_index))
@@ -1115,8 +1166,8 @@ tls_openssl_set_ciphers (char *ciphers)
       return -1;
     }
 
-  vec_validate (om->ciphers, strlen (ciphers) - 1);
-  for (i = 0; i < vec_len (om->ciphers); i++)
+  vec_validate (om->ciphers, strlen (ciphers));
+  for (i = 0; i < vec_len (om->ciphers) - 1; i++)
     {
       om->ciphers[i] = toupper (ciphers[i]);
     }