X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fplugins%2Ftlsopenssl%2Ftls_openssl.c;h=789c64d88d318483b21e5d739c05b4ef03df0fa3;hb=67d7acd05;hp=f897b64800bc5ed842b109190a4bce399ddf5360;hpb=aab0604c47f9d6e3fadb894b3f081085833f62b3;p=vpp.git diff --git a/src/plugins/tlsopenssl/tls_openssl.c b/src/plugins/tlsopenssl/tls_openssl.c index f897b64800b..789c64d88d3 100644 --- a/src/plugins/tlsopenssl/tls_openssl.c +++ b/src/plugins/tlsopenssl/tls_openssl.c @@ -26,6 +26,7 @@ #include #include #include +#include #define MAX_CRYPTO_LEN 64 @@ -109,83 +110,31 @@ openssl_lctx_get (u32 lctx_index) return pool_elt_at_index (openssl_main.lctx_pool, lctx_index); } -static int -openssl_read_from_bio_into_fifo (svm_fifo_t * f, BIO * bio) -{ - u32 enq_now, enq_max; - svm_fifo_chunk_t *c; - int read, rv; - - enq_max = svm_fifo_max_enqueue_prod (f); - if (!enq_max) - return 0; - - svm_fifo_fill_chunk_list (f); - - enq_now = clib_min (svm_fifo_max_write_chunk (f), enq_max); - if (!enq_now) - return 0; - - read = BIO_read (bio, svm_fifo_tail (f), enq_now); - if (read <= 0) - return 0; - - if (read == enq_now) - { - c = svm_fifo_tail_chunk (f); - while (read < enq_max) - { - c = c->next; - enq_now = clib_min (c->length, enq_max - read); - rv = BIO_read (bio, c->data, enq_now); - read += rv > 0 ? rv : 0; - - if (rv < enq_now) - break; - } - } - - svm_fifo_enqueue_nocopy (f, read); - - return read; -} - static int openssl_read_from_ssl_into_fifo (svm_fifo_t * f, SSL * ssl) { - u32 enq_now, enq_max; - svm_fifo_chunk_t *c; - int read, rv; - - enq_max = svm_fifo_max_enqueue_prod (f); - if (!enq_max) - return 0; - - svm_fifo_fill_chunk_list (f); + int read, rv, n_fs, i; + const int n_segs = 2; + svm_fifo_seg_t fs[n_segs]; + u32 max_enq; - enq_now = clib_min (svm_fifo_max_write_chunk (f), enq_max); - if (!enq_now) + max_enq = svm_fifo_max_enqueue_prod (f); + n_fs = svm_fifo_provision_chunks (f, fs, n_segs, max_enq); + if (n_fs < 0) return 0; - read = SSL_read (ssl, svm_fifo_tail (f), enq_now); + /* Return early if we can't read anything */ + read = SSL_read (ssl, fs[0].data, fs[0].len); if (read <= 0) return 0; - if (read == enq_now) + for (i = 1; i < n_fs; i++) { - c = svm_fifo_tail_chunk (f); - while (read < enq_max) - { - c = c->next; - if (!c) - break; - enq_now = clib_min (c->length, enq_max - read); - rv = SSL_read (ssl, c->data, enq_now); - read += rv > 0 ? rv : 0; - - if (rv < enq_now) - break; - } + rv = SSL_read (ssl, fs[i].data, fs[i].len); + read += rv > 0 ? rv : 0; + + if (rv < fs[i].len) + break; } svm_fifo_enqueue_nocopy (f, read); @@ -194,98 +143,31 @@ openssl_read_from_ssl_into_fifo (svm_fifo_t * f, SSL * ssl) } static int -openssl_write_from_fifo_into_bio (svm_fifo_t * f, BIO * bio, u32 len) -{ - svm_fifo_chunk_t *c; - int wrote, rv; - u32 deq_now; - - deq_now = clib_min (svm_fifo_max_read_chunk (f), len); - wrote = BIO_write (bio, svm_fifo_head (f), deq_now); - if (wrote <= 0) - return 0; - - if (wrote == deq_now) - { - c = svm_fifo_head_chunk (f); - while (wrote < len) - { - c = c->next; - deq_now = clib_min (c->length, len - wrote); - rv = BIO_write (bio, c->data, deq_now); - wrote += rv > 0 ? rv : 0; - - if (rv < deq_now) - break; - } - } - - svm_fifo_dequeue_drop (f, wrote); - - return wrote; -} - -static int -openssl_write_from_fifo_into_ssl (svm_fifo_t * f, SSL * ssl, u32 len) +openssl_write_from_fifo_into_ssl (svm_fifo_t *f, SSL *ssl, u32 max_len) { - svm_fifo_chunk_t *c; - int wrote = 0, rv; - u32 deq_now; + int wrote = 0, rv, i = 0, len; + const int n_segs = 2; + svm_fifo_seg_t fs[n_segs]; - deq_now = clib_min (svm_fifo_max_read_chunk (f), len); - wrote = SSL_write (ssl, svm_fifo_head (f), deq_now); - if (wrote <= 0) + len = svm_fifo_segments (f, 0, fs, n_segs, max_len); + if (len <= 0) return 0; - if (wrote == deq_now) + while (wrote < len && i < n_segs) { - c = svm_fifo_head_chunk (f); - while (wrote < len) - { - c = c->next; - deq_now = clib_min (c->length, len - wrote); - rv = SSL_write (ssl, c->data, deq_now); - wrote += rv > 0 ? rv : 0; - - if (rv < deq_now) - break; - } + rv = SSL_write (ssl, fs[i].data, fs[i].len); + wrote += (rv > 0) ? rv : 0; + if (rv < fs[i].len) + break; + i++; } - svm_fifo_dequeue_drop (f, wrote); + if (wrote) + svm_fifo_dequeue_drop (f, wrote); return wrote; } -static int -openssl_try_handshake_read (openssl_ctx_t * oc, session_t * tls_session) -{ - svm_fifo_t *f; - u32 deq_max; - - f = tls_session->rx_fifo; - deq_max = svm_fifo_max_dequeue_cons (f); - if (!deq_max) - return 0; - - return openssl_write_from_fifo_into_bio (f, oc->wbio, deq_max); -} - -static int -openssl_try_handshake_write (openssl_ctx_t * oc, session_t * tls_session) -{ - u32 read; - - if (BIO_ctrl_pending (oc->rbio) <= 0) - return 0; - - read = openssl_read_from_bio_into_fifo (tls_session->tx_fifo, oc->rbio); - if (read) - tls_add_vpp_q_tx_evt (tls_session); - - return read; -} - #ifdef HAVE_OPENSSL_ASYNC static int openssl_check_async_status (tls_ctx_t * ctx, openssl_resume_handler * handler, @@ -335,7 +217,7 @@ openssl_handle_handshake_failure (tls_ctx_t * ctx) /* * Also handles cleanup of the pre-allocated session */ - tls_notify_app_connected (ctx, /* is failed */ 1); + tls_notify_app_connected (ctx, SESSION_E_TLS_HANDSHAKE); } } @@ -351,7 +233,7 @@ openssl_ctx_handshake_rx (tls_ctx_t * ctx, session_t * tls_session) { ctx->resume = 0; } - else if (!openssl_try_handshake_read (oc, tls_session)) + else if (!svm_fifo_max_dequeue_cons (tls_session->rx_fifo)) break; rv = SSL_do_handshake (oc->ssl); @@ -374,9 +256,7 @@ openssl_ctx_handshake_rx (tls_ctx_t * ctx, session_t * tls_session) return -1; } - openssl_try_handshake_write (oc, tls_session); - - if (err != SSL_ERROR_WANT_WRITE) + if (err != SSL_ERROR_WANT_WRITE && err != SSL_ERROR_WANT_READ) break; } TLS_DBG (2, "tls state for %u is %s", oc->openssl_ctx_index, @@ -403,11 +283,11 @@ openssl_ctx_handshake_rx (tls_ctx_t * ctx, session_t * tls_session) */ if (ctx->srv_hostname) { - tls_notify_app_connected (ctx, /* is failed */ 0); + tls_notify_app_connected (ctx, SESSION_E_TLS_HANDSHAKE); return -1; } } - tls_notify_app_connected (ctx, /* is failed */ 0); + tls_notify_app_connected (ctx, SESSION_E_NONE); } else { @@ -431,58 +311,49 @@ openssl_confirm_app_close (tls_ctx_t * ctx) } static inline int -openssl_ctx_write (tls_ctx_t * ctx, session_t * app_session) +openssl_ctx_write (tls_ctx_t * ctx, session_t * app_session, + transport_send_params_t * sp) { openssl_ctx_t *oc = (openssl_ctx_t *) ctx; - int wrote = 0, read, max_buf = 100 * TLS_CHUNK_SIZE, max_space; - u32 deq_max, to_write; - session_t *tls_session; + u32 deq_max, space, enq_buf; + session_t *ts; + int wrote = 0; svm_fifo_t *f; + ts = session_get_from_handle (ctx->tls_session_handle); + space = svm_fifo_max_enqueue_prod (ts->tx_fifo); + /* Leave a bit of extra space for tls ctrl data, if any needed */ + space = clib_max ((int) space - TLSO_CTRL_BYTES, 0); + f = app_session->tx_fifo; deq_max = svm_fifo_max_dequeue_cons (f); + deq_max = clib_min (deq_max, space); if (!deq_max) goto check_tls_fifo; - /* Figure out how much data to write */ - max_space = max_buf - BIO_ctrl_pending (oc->rbio); - max_space = (max_space < 0) ? 0 : max_space; - to_write = clib_min (deq_max, (u32) max_space); + deq_max = clib_min (deq_max, sp->max_burst_size); - wrote = openssl_write_from_fifo_into_ssl (f, oc->ssl, to_write); + wrote = openssl_write_from_fifo_into_ssl (f, oc->ssl, deq_max); if (!wrote) - { - tls_add_vpp_q_builtin_tx_evt (app_session); - goto check_tls_fifo; - } + goto check_tls_fifo; if (svm_fifo_needs_deq_ntf (f, wrote)) session_dequeue_notify (app_session); - if (svm_fifo_max_dequeue_cons (f)) - tls_add_vpp_q_builtin_tx_evt (app_session); - check_tls_fifo: - if (BIO_ctrl_pending (oc->rbio) <= 0) - return wrote; - - tls_session = session_get_from_handle (ctx->tls_session_handle); - - read = openssl_read_from_bio_into_fifo (tls_session->tx_fifo, oc->rbio); - if (!read) + /* Deschedule and wait for deq notification if fifo is almost full */ + enq_buf = clib_min (svm_fifo_size (ts->tx_fifo) / 2, TLSO_MIN_ENQ_SPACE); + if (space < wrote + enq_buf) { - tls_add_vpp_q_builtin_tx_evt (app_session); - return wrote; + svm_fifo_add_want_deq_ntf (ts->tx_fifo, SVM_FIFO_WANT_DEQ_NOTIF); + transport_connection_deschedule (&ctx->connection); + sp->flags |= TRANSPORT_SND_F_DESCHED; } - - tls_add_vpp_q_tx_evt (tls_session); - - if (BIO_ctrl_pending (oc->rbio) > 0) - tls_add_vpp_q_builtin_tx_evt (app_session); - else if (ctx->app_closed) - openssl_confirm_app_close (ctx); + else + /* Request tx reschedule of the app session */ + app_session->flags |= SESSION_F_CUSTOM_TX; return wrote; } @@ -490,57 +361,26 @@ check_tls_fifo: static inline int openssl_ctx_read (tls_ctx_t * ctx, session_t * tls_session) { - int read, wrote = 0, max_space, max_buf = 100 * TLS_CHUNK_SIZE; openssl_ctx_t *oc = (openssl_ctx_t *) ctx; - u32 deq_max, to_write; session_t *app_session; + int read, wrote = 0; svm_fifo_t *f; if (PREDICT_FALSE (SSL_in_init (oc->ssl))) { if (openssl_ctx_handshake_rx (ctx, tls_session) < 0) return 0; - else - goto check_app_fifo; - } - - f = tls_session->rx_fifo; - - deq_max = svm_fifo_max_dequeue_cons (f); - max_space = max_buf - BIO_ctrl_pending (oc->wbio); - max_space = max_space < 0 ? 0 : max_space; - to_write = clib_min (deq_max, max_space); - if (!to_write) - goto check_app_fifo; - - wrote = openssl_write_from_fifo_into_bio (f, oc->wbio, to_write); - if (!wrote) - { - tls_add_vpp_q_builtin_rx_evt (tls_session); - goto check_app_fifo; } - if (svm_fifo_max_dequeue_cons (f)) - tls_add_vpp_q_builtin_rx_evt (tls_session); - -check_app_fifo: - - if (BIO_ctrl_pending (oc->wbio) <= 0) - return wrote; - app_session = session_get_from_handle (ctx->app_session_handle); f = app_session->rx_fifo; read = openssl_read_from_ssl_into_fifo (f, oc->ssl); - if (!read) - { - tls_add_vpp_q_builtin_rx_evt (tls_session); - return wrote; - } /* If handshake just completed, session may still be in accepting state */ - if (app_session->session_state >= SESSION_STATE_READY) + if (read && app_session->session_state >= SESSION_STATE_READY) tls_notify_app_enqueue (ctx, app_session); + if (SSL_pending (oc->ssl) > 0) tls_add_vpp_q_builtin_rx_evt (tls_session); @@ -553,7 +393,6 @@ openssl_ctx_init_client (tls_ctx_t * ctx) long flags = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION; openssl_ctx_t *oc = (openssl_ctx_t *) ctx; openssl_main_t *om = &openssl_main; - session_t *tls_session; const SSL_METHOD *method; int rv, err; @@ -594,11 +433,8 @@ openssl_ctx_init_client (tls_ctx_t * ctx) return -1; } - oc->rbio = BIO_new (BIO_s_mem ()); - oc->wbio = BIO_new (BIO_s_mem ()); - - BIO_set_mem_eof_return (oc->rbio, -1); - BIO_set_mem_eof_return (oc->wbio, -1); + oc->rbio = BIO_new_tls (ctx->tls_session_handle); + oc->wbio = BIO_new_tls (ctx->tls_session_handle); SSL_set_bio (oc->ssl, oc->wbio, oc->rbio); SSL_set_connect_state (oc->ssl); @@ -616,16 +452,14 @@ openssl_ctx_init_client (tls_ctx_t * ctx) TLS_DBG (1, "Initiating handshake for [%u]%u", ctx->c_thread_index, oc->openssl_ctx_index); - tls_session = session_get_from_handle (ctx->tls_session_handle); - #ifdef HAVE_OPENSSL_ASYNC + session_t *tls_session = session_get_from_handle (ctx->tls_session_handle); vpp_tls_async_init_event (ctx, openssl_ctx_handshake_rx, tls_session); #endif while (1) { rv = SSL_do_handshake (oc->ssl); err = SSL_get_error (oc->ssl, rv); - openssl_try_handshake_write (oc, tls_session); #ifdef HAVE_OPENSSL_ASYNC if (err == SSL_ERROR_WANT_ASYNC) { @@ -758,7 +592,6 @@ openssl_ctx_init_server (tls_ctx_t * ctx) openssl_ctx_t *oc = (openssl_ctx_t *) ctx; u32 olc_index = ctx->tls_ssl_ctx; openssl_listen_ctx_t *olc; - session_t *tls_session; int rv, err; /* Start a new connection */ @@ -771,11 +604,8 @@ openssl_ctx_init_server (tls_ctx_t * ctx) return -1; } - oc->rbio = BIO_new (BIO_s_mem ()); - oc->wbio = BIO_new (BIO_s_mem ()); - - BIO_set_mem_eof_return (oc->rbio, -1); - BIO_set_mem_eof_return (oc->wbio, -1); + oc->rbio = BIO_new_tls (ctx->tls_session_handle); + oc->wbio = BIO_new_tls (ctx->tls_session_handle); SSL_set_bio (oc->ssl, oc->wbio, oc->rbio); SSL_set_accept_state (oc->ssl); @@ -783,15 +613,14 @@ openssl_ctx_init_server (tls_ctx_t * ctx) TLS_DBG (1, "Initiating handshake for [%u]%u", ctx->c_thread_index, oc->openssl_ctx_index); - tls_session = session_get_from_handle (ctx->tls_session_handle); #ifdef HAVE_OPENSSL_ASYNC + session_t *tls_session = session_get_from_handle (ctx->tls_session_handle); vpp_tls_async_init_event (ctx, openssl_ctx_handshake_rx, tls_session); #endif while (1) { rv = SSL_do_handshake (oc->ssl); err = SSL_get_error (oc->ssl, rv); - openssl_try_handshake_write (oc, tls_session); #ifdef HAVE_OPENSSL_ASYNC if (err == SSL_ERROR_WANT_ASYNC) {