tls: avoid picotls buffer allocs on rx

[vpp.git] / src / plugins / tlspicotls / tls_picotls.c

diff --git a/src/plugins/tlspicotls/tls_picotls.c b/src/plugins/tlspicotls/tls_picotls.c
index a0fbab0..8768366 100644 (file)
--- a/src/plugins/tlspicotls/tls_picotls.c
+++ b/src/plugins/tlspicotls/tls_picotls.c
@@ -48,6 +48,7 @@ picotls_ctx_free (tls_ctx_t * ctx)
 {
   picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
   vec_free (ptls_ctx->rx_content);
+  ptls_free (ptls_ctx->tls);
   vec_free (ptls_ctx->write_content);
   pool_put_index (picotls_main.ctx_pool[ctx->c_thread_index],
                  ptls_ctx->ptls_ctx_idx);
@@ -200,8 +201,6 @@ picotls_transport_close (tls_ctx_t * ctx)
       picotls_handle_handshake_failure (ctx);
       return 0;
     }
-  picotls_ctx_t *ptls_ctx = (picotls_ctx_t *) ctx;
-  ptls_free (ptls_ctx->tls);
   session_transport_closing_notify (&ctx->connection);
   return 0;
 }
@@ -279,17 +278,31 @@ picotls_ctx_read (tls_ctx_t *ctx, session_t *tcp_session)
   int off = 0, ret, i = 0, read = 0, len;
   const int n_segs = 4, max_len = 32768;
   svm_fifo_t *tcp_rx_fifo, *app_rx_fifo;
+  picotls_main_t *pm = &picotls_main;
   svm_fifo_seg_t fs[n_segs];
   session_t *app_session;
+  u32 thread_index;
   uword deq_now;
 
   if (PREDICT_FALSE (!ptls_handshake_is_complete (ptls_ctx->tls)))
     {
       picotls_do_handshake (ptls_ctx, tcp_session);
       if (picotls_handshake_is_over (ctx))
-       ret = ptls_is_server (ptls_ctx->tls) ?
-               tls_notify_app_accept (ctx) :
-               tls_notify_app_connected (ctx, SESSION_E_NONE);
+       {
+         if (ptls_is_server (ptls_ctx->tls))
+           {
+             if (tls_notify_app_accept (ctx))
+               {
+                 ctx->c_s_index = SESSION_INVALID_INDEX;
+                 tls_disconnect_transport (ctx);
+                 return -1;
+               }
+           }
+         else
+           {
+             tls_notify_app_connected (ctx, SESSION_E_NONE);
+           }
+       }
 
       if (!svm_fifo_max_dequeue (tcp_session->rx_fifo))
        return 0;
@@ -306,7 +319,9 @@ picotls_ctx_read (tls_ctx_t *ctx, session_t *tcp_session)
   if (len <= 0)
     goto final_checks;
 
-  ptls_buffer_init (buf, "", 0);
+  thread_index = ptls_ctx->ctx.c_thread_index;
+  vec_validate (pm->rx_bufs[thread_index], 2 * max_len);
+  ptls_buffer_init (buf, pm->rx_bufs[thread_index], 2 * max_len);
   ptls_ctx->read_buffer_offset = 0;
 
   while (read < len && i < n_segs)
@@ -348,7 +363,8 @@ do_enq:
     }
   else
     {
-      ptls_buffer_dispose (buf);
+      buf->off = 0;
+      ptls_ctx->read_buffer_offset = 0;
     }
 
   if (app_session->session_state >= SESSION_STATE_READY)
@@ -612,7 +628,7 @@ tls_picotls_init (vlib_main_t * vm)
   num_threads = 1 + vtm->n_threads;
 
   vec_validate (pm->ctx_pool, num_threads - 1);
-
+  vec_validate (pm->rx_bufs, num_threads - 1);
   clib_rwlock_init (&picotls_main.crypto_keys_rw_lock);
 
   tls_register_engine (&picotls_engine, CRYPTO_ENGINE_PICOTLS);