if (!(*ctx))
*ctx = clib_mem_alloc (sizeof (openssl_ctx_t));
- memset (*ctx, 0, sizeof (openssl_ctx_t));
+ clib_memset (*ctx, 0, sizeof (openssl_ctx_t));
(*ctx)->ctx.c_thread_index = thread_index;
(*ctx)->ctx.tls_ctx_engine = TLS_ENGINE_OPENSSL;
(*ctx)->ctx.app_session_handle = SESSION_INVALID_HANDLE;
pool_get (om->lctx_pool, lctx);
- memset (lctx, 0, sizeof (openssl_listen_ctx_t));
+ clib_memset (lctx, 0, sizeof (openssl_listen_ctx_t));
lctx->openssl_lctx_index = lctx - om->lctx_pool;
return lctx->openssl_lctx_index;
}
return 0;
svm_fifo_enqueue_nocopy (f, read);
- tls_add_vpp_q_evt (f, FIFO_EVENT_APP_TX);
+ tls_add_vpp_q_tx_evt (tls_session);
if (read < enq_max)
{
engine_cb = vpp_add_async_pending_event (ctx, handler);
if (engine_cb)
{
- SSL_set_async_callback (oc->ssl, (void *) engine_cb->callback,
- (void *) engine_cb->arg);
+ SSL_set_async_callback_arg (oc->ssl, (void *) engine_cb->arg);
TLS_DBG (2, "set callback to engine %p\n", engine_cb->callback);
}
return 0;
if (vpp_add_async_run_event (ctx, handler))
{
- SSL_set_async_estatus (oc->ssl, 0);
+ SSL_clear_async_status (oc->ssl);
}
return 0;
break;
}
+#ifdef HAVE_OPENSSL_ASYNC
+ myself = openssl_ctx_handshake_rx;
+ vpp_ssl_async_process_event (ctx, myself);
+#endif
+
rv = SSL_do_handshake (oc->ssl);
err = SSL_get_error (oc->ssl, rv);
openssl_try_handshake_write (oc, tls_session);
#ifdef HAVE_OPENSSL_ASYNC
- myself = openssl_ctx_handshake_rx;
- if (SSL_get_async_estatus (oc->ssl, &estatus)
- && (estatus == ENGINE_STATUS_RETRY))
- {
- vpp_ssl_async_retry_func (ctx, myself);
- }
- else if (err == SSL_ERROR_WANT_ASYNC)
+ if (err == SSL_ERROR_WANT_ASYNC)
{
- vpp_ssl_async_process_event (ctx, myself);
+ SSL_get_async_status (oc->ssl, &estatus);
+
+ if (estatus == ASYNC_STATUS_EAGAIN)
+ {
+ vpp_ssl_async_retry_func (ctx, myself);
+ }
}
#endif
wrote = SSL_write (oc->ssl, svm_fifo_head (f), to_write);
if (wrote <= 0)
{
- tls_add_vpp_q_evt (app_session->server_tx_fifo, FIFO_EVENT_APP_TX);
+ tls_add_vpp_q_builtin_tx_evt (app_session);
goto check_tls_fifo;
}
svm_fifo_dequeue_drop (app_session->server_tx_fifo, wrote);
}
}
- if (deq_now < deq_max)
- tls_add_vpp_q_evt (app_session->server_tx_fifo, FIFO_EVENT_APP_TX);
+ if (wrote < deq_max)
+ tls_add_vpp_q_builtin_tx_evt (app_session);
check_tls_fifo:
enq_max = svm_fifo_max_enqueue (f);
if (!enq_max)
{
- tls_add_vpp_q_evt (app_session->server_tx_fifo, FIFO_EVENT_APP_TX);
+ tls_add_vpp_q_builtin_tx_evt (app_session);
return wrote;
}
read = BIO_read (oc->rbio, svm_fifo_tail (f), deq_now);
if (read <= 0)
{
- tls_add_vpp_q_evt (app_session->server_tx_fifo, FIFO_EVENT_APP_TX);
+ tls_add_vpp_q_builtin_tx_evt (app_session);
return wrote;
}
svm_fifo_enqueue_nocopy (f, read);
- tls_add_vpp_q_evt (f, FIFO_EVENT_APP_TX);
+ tls_add_vpp_q_tx_evt (tls_session);
if (read < enq_max && BIO_ctrl_pending (oc->rbio) > 0)
{
}
if (BIO_ctrl_pending (oc->rbio) > 0)
- tls_add_vpp_q_evt (app_session->server_tx_fifo, FIFO_EVENT_APP_TX);
+ tls_add_vpp_q_builtin_tx_evt (app_session);
return wrote;
}
wrote = BIO_write (oc->wbio, svm_fifo_head (f), to_read);
if (wrote <= 0)
{
- tls_add_vpp_q_evt (tls_session->server_rx_fifo, FIFO_EVENT_BUILTIN_RX);
+ tls_add_vpp_q_builtin_rx_evt (tls_session);
goto check_app_fifo;
}
svm_fifo_dequeue_drop (f, wrote);
}
}
if (svm_fifo_max_dequeue (f))
- tls_add_vpp_q_evt (tls_session->server_rx_fifo, FIFO_EVENT_BUILTIN_RX);
+ tls_add_vpp_q_builtin_rx_evt (tls_session);
check_app_fifo:
enq_max = svm_fifo_max_enqueue (f);
if (!enq_max)
{
- tls_add_vpp_q_evt (tls_session->server_rx_fifo, FIFO_EVENT_BUILTIN_RX);
+ tls_add_vpp_q_builtin_rx_evt (tls_session);
return wrote;
}
read = SSL_read (oc->ssl, svm_fifo_tail (f), deq_now);
if (read <= 0)
{
- tls_add_vpp_q_evt (tls_session->server_rx_fifo, FIFO_EVENT_BUILTIN_RX);
+ tls_add_vpp_q_builtin_rx_evt (tls_session);
return wrote;
}
svm_fifo_enqueue_nocopy (f, read);
tls_notify_app_enqueue (ctx, app_session);
if (BIO_ctrl_pending (oc->wbio) > 0)
- tls_add_vpp_q_evt (tls_session->server_rx_fifo, FIFO_EVENT_BUILTIN_RX);
+ tls_add_vpp_q_builtin_rx_evt (tls_session);
return wrote;
}
static int
openssl_ctx_init_client (tls_ctx_t * ctx)
{
- char *ciphers = "ALL:!ADH:!LOW:!EXP:!MD5:!RC4-SHA:!DES-CBC3-SHA:@STRENGTH";
long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
openssl_ctx_t *oc = (openssl_ctx_t *) ctx;
openssl_main_t *om = &openssl_main;
if (om->async)
SSL_CTX_set_mode (oc->ssl_ctx, SSL_MODE_ASYNC);
#endif
- rv = SSL_CTX_set_cipher_list (oc->ssl_ctx, (const char *) ciphers);
+ rv = SSL_CTX_set_cipher_list (oc->ssl_ctx, (const char *) om->ciphers);
if (rv != 1)
{
TLS_DBG (1, "Couldn't set cipher");
u32 olc_index;
openssl_listen_ctx_t *olc;
- char *ciphers = "ALL:!ADH:!LOW:!EXP:!MD5:!RC4-SHA:!DES-CBC3-SHA:@STRENGTH";
long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
-#ifdef HAVE_OPENSSL_ASYNC
openssl_main_t *om = &openssl_main;
-#endif
app = application_get (lctx->parent_app_index);
if (!app->tls_cert || !app->tls_key)
#ifdef HAVE_OPENSSL_ASYNC
if (om->async)
SSL_CTX_set_mode (ssl_ctx, SSL_MODE_ASYNC);
+ SSL_CTX_set_async_callback (ssl_ctx, tls_async_openssl_callback);
#endif
SSL_CTX_set_options (ssl_ctx, flags);
SSL_CTX_set_ecdh_auto (ssl_ctx, 1);
- rv = SSL_CTX_set_cipher_list (ssl_ctx, (const char *) ciphers);
+ rv = SSL_CTX_set_cipher_list (ssl_ctx, (const char *) om->ciphers);
if (rv != 1)
{
TLS_DBG (1, "Couldn't set cipher");
return (rv < 0 ? -1 : 0);
}
+static int
+tls_openssl_set_ciphers (char *ciphers)
+{
+ openssl_main_t *om = &openssl_main;
+ int i;
+
+ if (!ciphers)
+ {
+ return -1;
+ }
+
+ vec_validate (om->ciphers, strlen (ciphers) - 1);
+ for (i = 0; i < vec_len (om->ciphers); i++)
+ {
+ om->ciphers[i] = toupper (ciphers[i]);
+ }
+
+ return 0;
+
+}
+
static clib_error_t *
tls_openssl_init (vlib_main_t * vm)
{
om->engine_init = 0;
+ /* default ciphers */
+ tls_openssl_set_ciphers
+ ("ALL:!ADH:!LOW:!EXP:!MD5:!RC4-SHA:!DES-CBC3-SHA:@STRENGTH");
+
return 0;
}
openssl_main_t *om = &openssl_main;
char *engine_name = NULL;
char *engine_alg = NULL;
+ char *ciphers = NULL;
u8 engine_name_set = 0;
int i;
for (i = 0; i < strnlen (engine_alg, MAX_CRYPTO_LEN); i++)
engine_alg[i] = toupper (engine_alg[i]);
}
+ else if (unformat (input, "ciphers %s", &ciphers))
+ {
+ tls_openssl_set_ciphers (ciphers);
+ }
else
return clib_error_return (0, "failed: unknown input `%U'",
format_unformat_error, input);