X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=blobdiff_plain;f=src%2Fplugins%2Ftlsopenssl%2Ftls_openssl.c;h=00cd462189732cc6f985a1b18cfa24c7ee067be2;hp=789c64d88d318483b21e5d739c05b4ef03df0fa3;hb=4b47ee26c;hpb=da2305fb874a7cf6573267adb87166564e328396 diff --git a/src/plugins/tlsopenssl/tls_openssl.c b/src/plugins/tlsopenssl/tls_openssl.c index 789c64d88d3..00cd4621897 100644 --- a/src/plugins/tlsopenssl/tls_openssl.c +++ b/src/plugins/tlsopenssl/tls_openssl.c @@ -26,19 +26,19 @@ #include #include #include -#include +#include #define MAX_CRYPTO_LEN 64 openssl_main_t openssl_main; + static u32 -openssl_ctx_alloc (void) +openssl_ctx_alloc_w_thread (u32 thread_index) { - u8 thread_index = vlib_get_thread_index (); - openssl_main_t *tm = &openssl_main; + openssl_main_t *om = &openssl_main; openssl_ctx_t **ctx; - pool_get (tm->ctx_pool[thread_index], ctx); + pool_get (om->ctx_pool[thread_index], ctx); if (!(*ctx)) *ctx = clib_mem_alloc (sizeof (openssl_ctx_t)); @@ -46,10 +46,16 @@ openssl_ctx_alloc (void) (*ctx)->ctx.c_thread_index = thread_index; (*ctx)->ctx.tls_ctx_engine = CRYPTO_ENGINE_OPENSSL; (*ctx)->ctx.app_session_handle = SESSION_INVALID_HANDLE; - (*ctx)->openssl_ctx_index = ctx - tm->ctx_pool[thread_index]; + (*ctx)->openssl_ctx_index = ctx - om->ctx_pool[thread_index]; return ((*ctx)->openssl_ctx_index); } +static u32 +openssl_ctx_alloc (void) +{ + return openssl_ctx_alloc_w_thread (vlib_get_thread_index ()); +} + static void openssl_ctx_free (tls_ctx_t * ctx) { @@ -68,6 +74,40 @@ openssl_ctx_free (tls_ctx_t * ctx) oc->openssl_ctx_index); } +static void * +openssl_ctx_detach (tls_ctx_t *ctx) +{ + openssl_ctx_t *oc = (openssl_ctx_t *) ctx, *oc_copy; + + oc_copy = clib_mem_alloc (sizeof (*oc_copy)); + clib_memcpy (oc_copy, oc, sizeof (*oc)); + + return oc_copy; +} + +static u32 +openssl_ctx_attach (u32 thread_index, void *ctx_ptr) +{ + openssl_main_t *om = &openssl_main; + session_handle_t sh; + openssl_ctx_t **oc; + + pool_get (om->ctx_pool[thread_index], oc); + /* Free the old instance instead of looking for an empty spot */ + if (*oc) + clib_mem_free (*oc); + + *oc = ctx_ptr; + (*oc)->openssl_ctx_index = oc - om->ctx_pool[thread_index]; + (*oc)->ctx.c_thread_index = thread_index; + + sh = (*oc)->ctx.tls_session_handle; + BIO_set_data ((*oc)->rbio, uword_to_pointer (sh, void *)); + BIO_set_data ((*oc)->wbio, uword_to_pointer (sh, void *)); + + return ((*oc)->openssl_ctx_index); +} + tls_ctx_t * openssl_ctx_get (u32 ctx_index) { @@ -310,9 +350,9 @@ openssl_confirm_app_close (tls_ctx_t * ctx) session_transport_closed_notify (&ctx->connection); } -static inline int -openssl_ctx_write (tls_ctx_t * ctx, session_t * app_session, - transport_send_params_t * sp) +static int +openssl_ctx_write_tls (tls_ctx_t *ctx, session_t *app_session, + transport_send_params_t *sp) { openssl_ctx_t *oc = (openssl_ctx_t *) ctx; u32 deq_max, space, enq_buf; @@ -358,8 +398,77 @@ check_tls_fifo: return wrote; } +static int +openssl_ctx_write_dtls (tls_ctx_t *ctx, session_t *app_session, + transport_send_params_t *sp) +{ + openssl_main_t *om = &openssl_main; + openssl_ctx_t *oc = (openssl_ctx_t *) ctx; + session_dgram_pre_hdr_t hdr; + session_t *us; + int wrote, rv; + u32 read = 0, to_deq, dgram_sz; + u8 *buf; + + us = session_get_from_handle (ctx->tls_session_handle); + to_deq = svm_fifo_max_dequeue_cons (app_session->tx_fifo); + buf = om->tx_bufs[ctx->c_thread_index]; + + while (to_deq > 0) + { + /* Peeking only pre-header dgram because the session is connected */ + rv = svm_fifo_peek (app_session->tx_fifo, 0, sizeof (hdr), (u8 *) &hdr); + ASSERT (rv == sizeof (hdr) && hdr.data_length < vec_len (buf)); + ASSERT (to_deq >= hdr.data_length + SESSION_CONN_HDR_LEN); + + dgram_sz = hdr.data_length + SESSION_CONN_HDR_LEN; + if (svm_fifo_max_enqueue_prod (us->tx_fifo) < dgram_sz + TLSO_CTRL_BYTES) + { + svm_fifo_add_want_deq_ntf (us->tx_fifo, SVM_FIFO_WANT_DEQ_NOTIF); + transport_connection_deschedule (&ctx->connection); + sp->flags |= TRANSPORT_SND_F_DESCHED; + goto done; + } + + rv = svm_fifo_peek (app_session->tx_fifo, SESSION_CONN_HDR_LEN, + hdr.data_length, buf); + ASSERT (rv == hdr.data_length); + svm_fifo_dequeue_drop (app_session->tx_fifo, dgram_sz); + + wrote = SSL_write (oc->ssl, buf, rv); + ASSERT (wrote > 0); + + read += rv; + to_deq -= dgram_sz; + } + +done: + + if (svm_fifo_needs_deq_ntf (app_session->tx_fifo, read)) + session_dequeue_notify (app_session); + + if (read) + tls_add_vpp_q_tx_evt (us); + + if (PREDICT_FALSE (ctx->app_closed && + !svm_fifo_max_enqueue_prod (us->rx_fifo))) + openssl_confirm_app_close (ctx); + + return read; +} + +static inline int +openssl_ctx_write (tls_ctx_t *ctx, session_t *app_session, + transport_send_params_t *sp) +{ + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + return openssl_ctx_write_tls (ctx, app_session, sp); + else + return openssl_ctx_write_dtls (ctx, app_session, sp); +} + static inline int -openssl_ctx_read (tls_ctx_t * ctx, session_t * tls_session) +openssl_ctx_read_tls (tls_ctx_t *ctx, session_t *tls_session) { openssl_ctx_t *oc = (openssl_ctx_t *) ctx; session_t *app_session; @@ -387,6 +496,76 @@ openssl_ctx_read (tls_ctx_t * ctx, session_t * tls_session) return wrote; } +static inline int +openssl_ctx_read_dtls (tls_ctx_t *ctx, session_t *us) +{ + openssl_main_t *om = &openssl_main; + openssl_ctx_t *oc = (openssl_ctx_t *) ctx; + session_dgram_hdr_t hdr; + session_t *app_session; + u32 wrote = 0; + int read, rv; + u8 *buf; + + if (PREDICT_FALSE (SSL_in_init (oc->ssl))) + { + u32 us_index = us->session_index; + if (openssl_ctx_handshake_rx (ctx, us) < 0) + return 0; + /* Session pool might grow when allocating the app's session */ + us = session_get (us_index, ctx->c_thread_index); + } + + buf = om->rx_bufs[ctx->c_thread_index]; + app_session = session_get_from_handle (ctx->app_session_handle); + svm_fifo_fill_chunk_list (app_session->rx_fifo); + + while (svm_fifo_max_dequeue_cons (us->rx_fifo) > 0) + { + if (svm_fifo_max_enqueue_prod (app_session->rx_fifo) < DTLSO_MAX_DGRAM) + { + tls_add_vpp_q_builtin_rx_evt (us); + goto done; + } + + read = SSL_read (oc->ssl, buf, vec_len (buf)); + if (PREDICT_FALSE (read <= 0)) + { + if (read < 0) + tls_add_vpp_q_builtin_rx_evt (us); + goto done; + } + wrote += read; + + hdr.data_length = read; + hdr.data_offset = 0; + + svm_fifo_seg_t segs[2] = { { (u8 *) &hdr, sizeof (hdr) }, + { buf, read } }; + + rv = svm_fifo_enqueue_segments (app_session->rx_fifo, segs, 2, + 0 /* allow partial */); + ASSERT (rv > 0); + } + +done: + + /* If handshake just completed, session may still be in accepting state */ + if (app_session->session_state >= SESSION_STATE_READY) + tls_notify_app_enqueue (ctx, app_session); + + return wrote; +} + +static inline int +openssl_ctx_read (tls_ctx_t *ctx, session_t *ts) +{ + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + return openssl_ctx_read_tls (ctx, ts); + else + return openssl_ctx_read_dtls (ctx, ts); +} + static int openssl_ctx_init_client (tls_ctx_t * ctx) { @@ -396,10 +575,11 @@ openssl_ctx_init_client (tls_ctx_t * ctx) const SSL_METHOD *method; int rv, err; - method = SSLv23_client_method (); + method = ctx->tls_type == TRANSPORT_PROTO_TLS ? SSLv23_client_method () : + DTLS_client_method (); if (method == NULL) { - TLS_DBG (1, "SSLv23_method returned null"); + TLS_DBG (1, "(D)TLS_method returned null"); return -1; } @@ -433,8 +613,16 @@ openssl_ctx_init_client (tls_ctx_t * ctx) return -1; } - oc->rbio = BIO_new_tls (ctx->tls_session_handle); - oc->wbio = BIO_new_tls (ctx->tls_session_handle); + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + { + oc->rbio = BIO_new_tls (ctx->tls_session_handle); + oc->wbio = BIO_new_tls (ctx->tls_session_handle); + } + else + { + oc->rbio = BIO_new_dtls (ctx->tls_session_handle); + oc->wbio = BIO_new_dtls (ctx->tls_session_handle); + } SSL_set_bio (oc->ssl, oc->wbio, oc->rbio); SSL_set_connect_state (oc->ssl); @@ -504,7 +692,8 @@ openssl_start_listen (tls_ctx_t * lctx) return -1; } - method = SSLv23_method (); + method = lctx->tls_type == TRANSPORT_PROTO_TLS ? SSLv23_server_method () : + DTLS_server_method (); ssl_ctx = SSL_CTX_new (method); if (!ssl_ctx) { @@ -604,8 +793,16 @@ openssl_ctx_init_server (tls_ctx_t * ctx) return -1; } - oc->rbio = BIO_new_tls (ctx->tls_session_handle); - oc->wbio = BIO_new_tls (ctx->tls_session_handle); + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + { + oc->rbio = BIO_new_tls (ctx->tls_session_handle); + oc->wbio = BIO_new_tls (ctx->tls_session_handle); + } + else + { + oc->rbio = BIO_new_dtls (ctx->tls_session_handle); + oc->wbio = BIO_new_dtls (ctx->tls_session_handle); + } SSL_set_bio (oc->ssl, oc->wbio, oc->rbio); SSL_set_accept_state (oc->ssl); @@ -682,7 +879,10 @@ openssl_app_close (tls_ctx_t * ctx) const static tls_engine_vft_t openssl_engine = { .ctx_alloc = openssl_ctx_alloc, + .ctx_alloc_w_thread = openssl_ctx_alloc_w_thread, .ctx_free = openssl_ctx_free, + .ctx_attach = openssl_ctx_attach, + .ctx_detach = openssl_ctx_detach, .ctx_get = openssl_ctx_get, .ctx_get_w_thread = openssl_ctx_get_w_thread, .ctx_init_server = openssl_ctx_init_server, @@ -771,7 +971,7 @@ tls_openssl_init (vlib_main_t * vm) vlib_thread_main_t *vtm = vlib_get_thread_main (); openssl_main_t *om = &openssl_main; clib_error_t *error = 0; - u32 num_threads; + u32 num_threads, i; error = tls_openssl_api_init (vm); num_threads = 1 /* main thread */ + vtm->n_threads; @@ -786,7 +986,13 @@ tls_openssl_init (vlib_main_t * vm) } vec_validate (om->ctx_pool, num_threads - 1); - + vec_validate (om->rx_bufs, num_threads - 1); + vec_validate (om->tx_bufs, num_threads - 1); + for (i = 0; i < num_threads; i++) + { + vec_validate (om->rx_bufs[i], DTLSO_MAX_DGRAM); + vec_validate (om->tx_bufs[i], DTLSO_MAX_DGRAM); + } tls_register_engine (&openssl_engine, CRYPTO_ENGINE_OPENSSL); om->engine_init = 0;