#ifndef SRC_VNET_TLS_TLS_H_
#define SRC_VNET_TLS_TLS_H_
-#define TLS_DEBUG 0
+#define TLS_DEBUG 0
#define TLS_DEBUG_LEVEL_CLIENT 0
#define TLS_DEBUG_LEVEL_SERVER 0
#define TLS_DBG(_lvl, _fmt, _args...)
#endif
-/* *INDENT-OFF* */
typedef struct tls_cxt_id_
{
- union {
- session_handle_t app_session_handle;
- u32 parent_app_api_ctx;
- };
+ session_handle_t app_session_handle;
session_handle_t tls_session_handle;
+ void *migrate_ctx;
u32 parent_app_wrk_index;
u32 ssl_ctx;
- u32 listener_ctx_index;
+ union
+ {
+ u32 listener_ctx_index;
+ u32 parent_app_api_ctx;
+ };
u8 tcp_is_ip4;
u8 tls_engine_id;
} tls_ctx_id_t;
-/* *INDENT-ON* */
STATIC_ASSERT (sizeof (tls_ctx_id_t) <= TRANSPORT_CONN_ID_LEN,
"ctx id must be less than TRANSPORT_CONN_ID_LEN");
+#define foreach_tls_conn_flags \
+ _ (HO_DONE, "ho-done") \
+ _ (PASSIVE_CLOSE, "passive-close") \
+ _ (APP_CLOSED, "app-closed") \
+ _ (MIGRATED, "migrated") \
+ _ (NO_APP_SESSION, "no-app-session") \
+ _ (RESUME, "resume") \
+ _ (HS_DONE, "handshake-done")
+
+typedef enum tls_conn_flags_bit_
+{
+#define _(sym, str) TLS_CONN_F_BIT_##sym,
+ foreach_tls_conn_flags
+#undef _
+} tls_conn_flags_bit_t;
+
+typedef enum tls_conn_flags_
+{
+#define _(sym, str) TLS_CONN_F_##sym = 1 << TLS_CONN_F_BIT_##sym,
+ foreach_tls_conn_flags
+#undef _
+} __clib_packed tls_conn_flags_t;
+
typedef struct tls_ctx_
{
union
/* Temporary storage for session open opaque. Overwritten once
* underlying tcp connection is established */
#define parent_app_api_context c_tls_ctx_id.parent_app_api_ctx
+#define migration_ctx c_tls_ctx_id.migrate_ctx
- u8 is_passive_close;
- u8 resume;
- u8 app_closed;
- u8 no_app_session;
+ tls_conn_flags_t flags;
u8 *srv_hostname;
u32 evt_index;
u32 ckpair_index;
+ transport_proto_t tls_type;
} tls_ctx_t;
typedef struct tls_main_
u32 app_index;
tls_ctx_t *listener_ctx_pool;
tls_ctx_t *half_open_ctx_pool;
- clib_rwlock_t half_open_rwlock;
+ u32 *postponed_ho_free;
+ u32 *ho_free_list;
u8 **rx_bufs;
u8 **tx_bufs;
u8 use_test_cert_in_ca;
char *ca_cert_path;
u64 first_seg_size;
+ u64 add_seg_size;
u32 fifo_size;
} tls_main_t;
typedef struct tls_engine_vft_
{
u32 (*ctx_alloc) (void);
+ u32 (*ctx_alloc_w_thread) (u32 thread_index);
void (*ctx_free) (tls_ctx_t * ctx);
+ void *(*ctx_detach) (tls_ctx_t *ctx);
+ u32 (*ctx_attach) (u32 thread_index, void *ctx);
tls_ctx_t *(*ctx_get) (u32 ctx_index);
tls_ctx_t *(*ctx_get_w_thread) (u32 ctx_index, u8 thread_index);
int (*ctx_init_client) (tls_ctx_t * ctx);
int (*ctx_init_server) (tls_ctx_t * ctx);
int (*ctx_read) (tls_ctx_t * ctx, session_t * tls_session);
- int (*ctx_write) (tls_ctx_t * ctx, session_t * app_session);
+ int (*ctx_write) (tls_ctx_t * ctx, session_t * app_session,
+ transport_send_params_t * sp);
u8 (*ctx_handshake_is_over) (tls_ctx_t * ctx);
int (*ctx_start_listen) (tls_ctx_t * ctx);
int (*ctx_stop_listen) (tls_ctx_t * ctx);
int (*ctx_transport_close) (tls_ctx_t * ctx);
+ int (*ctx_transport_reset) (tls_ctx_t *ctx);
int (*ctx_app_close) (tls_ctx_t * ctx);
+ int (*ctx_reinit_cachain) (void);
} tls_engine_vft_t;
tls_main_t *vnet_tls_get_main (void);
int tls_add_vpp_q_builtin_tx_evt (session_t * s);
int tls_add_vpp_q_builtin_rx_evt (session_t * s);
int tls_notify_app_accept (tls_ctx_t * ctx);
-int tls_notify_app_connected (tls_ctx_t * ctx, u8 is_failed);
+int tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err);
void tls_notify_app_enqueue (tls_ctx_t * ctx, session_t * app_session);
+void tls_notify_app_io_error (tls_ctx_t *ctx);
void tls_disconnect_transport (tls_ctx_t * ctx);
+int tls_reinit_ca_chain (crypto_engine_type_t tls_engine_id);
+
+void tls_add_postponed_ho_cleanups (u32 ho_index);
+void tls_flush_postponed_ho_cleanups ();
+
#endif /* SRC_VNET_TLS_TLS_H_ */
/*