From 4b47ee26cba610b26bbfc088736846541bee7be3 Mon Sep 17 00:00:00 2001 From: Florin Coras Date: Thu, 19 Nov 2020 13:38:26 -0800 Subject: [PATCH] tls: dtls initial implementation Type: feature Basic dtls transport protocol implementation that relies on openssl wire protocol implementation. Retries/timeouts not yet supported. To test using vcl test apps, first ensure all arp entries are properly resolved and subsequently: server: vcl_server -p dtls 1234 client: vcl_client -p dtls 1234 -U -N 2000000 -T 1460 -X Signed-off-by: Florin Coras Change-Id: I04b4516a8fe9ce85ba230bcdd891f33a900046ed --- src/plugins/hs_apps/sapi/vpp_echo_common.c | 3 + src/plugins/hs_apps/vcl/vcl_test_client.c | 3 +- src/plugins/hs_apps/vcl/vcl_test_server.c | 5 +- src/plugins/tlsopenssl/CMakeLists.txt | 1 + src/plugins/tlsopenssl/dtls_bio.c | 225 ++++++++++++++++++++ src/plugins/tlsopenssl/{tls_bio.h => tls_bios.h} | 1 + src/plugins/tlsopenssl/tls_openssl.c | 244 ++++++++++++++++++++-- src/plugins/tlsopenssl/tls_openssl.h | 10 + src/vcl/vcl_private.h | 5 +- src/vcl/vppcom.c | 7 + src/vcl/vppcom.h | 47 ++--- src/vnet/session/session.c | 2 +- src/vnet/session/transport_types.h | 13 +- src/vnet/tls/tls.c | 253 +++++++++++++++++++++-- src/vnet/tls/tls.h | 9 +- 15 files changed, 751 insertions(+), 77 deletions(-) create mode 100644 src/plugins/tlsopenssl/dtls_bio.c rename src/plugins/tlsopenssl/{tls_bio.h => tls_bios.h} (95%) diff --git a/src/plugins/hs_apps/sapi/vpp_echo_common.c b/src/plugins/hs_apps/sapi/vpp_echo_common.c index e24629b783e..02ce1686ea2 100644 --- a/src/plugins/hs_apps/sapi/vpp_echo_common.c +++ b/src/plugins/hs_apps/sapi/vpp_echo_common.c @@ -339,6 +339,9 @@ format_transport_proto (u8 * s, va_list * args) case TRANSPORT_PROTO_QUIC: s = format (s, "QUIC"); break; + case TRANSPORT_PROTO_DTLS: + s = format (s, "DTLS"); + break; default: s = format (s, "UNKNOWN"); break; diff --git a/src/plugins/hs_apps/vcl/vcl_test_client.c b/src/plugins/hs_apps/vcl/vcl_test_client.c index 0aff98ef1dd..35f1ac11818 100644 --- a/src/plugins/hs_apps/vcl/vcl_test_client.c +++ b/src/plugins/hs_apps/vcl/vcl_test_client.c @@ -1105,7 +1105,8 @@ main (int argc, char **argv) if (ctrl->fd < 0) vtfail ("vppcom_session_create()", ctrl->fd); - if (vcm->proto == VPPCOM_PROTO_TLS || vcm->proto == VPPCOM_PROTO_QUIC) + if (vcm->proto == VPPCOM_PROTO_TLS || vcm->proto == VPPCOM_PROTO_QUIC || + vcm->proto == VPPCOM_PROTO_DTLS) { vppcom_cert_key_pair_t ckpair; uint32_t ckp_len; diff --git a/src/plugins/hs_apps/vcl/vcl_test_server.c b/src/plugins/hs_apps/vcl/vcl_test_server.c index a2a4d6ac3b0..b4966bf168b 100644 --- a/src/plugins/hs_apps/vcl/vcl_test_server.c +++ b/src/plugins/hs_apps/vcl/vcl_test_server.c @@ -550,8 +550,9 @@ vts_worker_init (vcl_test_server_worker_t * wrk) vppcom_session_attr (wrk->listen_fd, VPPCOM_ATTR_SET_CONNECTED, 0, 0); } - if (vsm->cfg.proto == VPPCOM_PROTO_TLS - || vsm->cfg.proto == VPPCOM_PROTO_QUIC) + if (vsm->cfg.proto == VPPCOM_PROTO_TLS || + vsm->cfg.proto == VPPCOM_PROTO_QUIC || + vsm->cfg.proto == VPPCOM_PROTO_DTLS) { vppcom_cert_key_pair_t ckpair; uint32_t ckp_len; diff --git a/src/plugins/tlsopenssl/CMakeLists.txt b/src/plugins/tlsopenssl/CMakeLists.txt index 61d3638a39a..eb67e4cceaf 100644 --- a/src/plugins/tlsopenssl/CMakeLists.txt +++ b/src/plugins/tlsopenssl/CMakeLists.txt @@ -20,6 +20,7 @@ if(OPENSSL_FOUND AND OPENSSL_VERSION VERSION_GREATER_EQUAL "1.1.0") tls_openssl.c tls_openssl_api.c tls_async.c + dtls_bio.c API_FILES tls_openssl.api diff --git a/src/plugins/tlsopenssl/dtls_bio.c b/src/plugins/tlsopenssl/dtls_bio.c new file mode 100644 index 00000000000..7cd2abd42e2 --- /dev/null +++ b/src/plugins/tlsopenssl/dtls_bio.c @@ -0,0 +1,225 @@ +/* + * Copyright (c) 2021 Cisco and/or its affiliates. + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include +#include + +#include +#include + +static inline session_t * +bio_session (BIO *bio) +{ + return session_get_from_handle (pointer_to_uword (BIO_get_data (bio))); +} + +static int +bio_dtls_alloc (BIO *bio) +{ + BIO_set_init (bio, 0); + BIO_set_data (bio, 0); + BIO_set_flags (bio, 0); + BIO_set_shutdown (bio, 0); + return 1; +} + +static int +bio_dtls_free (BIO *bio) +{ + if (!bio) + return 0; + + if (BIO_get_shutdown (bio)) + { + if (BIO_get_init (bio)) + session_close (bio_session (bio)); + BIO_set_init (bio, 0); + BIO_set_flags (bio, 0); + } + return 1; +} + +static int +bio_dtls_read (BIO *b, char *out, int outl) +{ + app_session_transport_t at; + session_t *s; + int rv; + + if (PREDICT_FALSE (!out)) + return 0; + + s = bio_session (b); + if (!s) + { + clib_warning ("no session"); + errno = EBADFD; + return -1; + } + + rv = app_recv_dgram_raw (s->rx_fifo, (u8 *) out, outl, &at, + 0 /* clear evt */, 0 /* peek */); + + if (rv < 0) + { + BIO_set_retry_read (b); + errno = EAGAIN; + return -1; + } + + if (svm_fifo_is_empty_cons (s->rx_fifo)) + svm_fifo_unset_event (s->rx_fifo); + + BIO_clear_retry_flags (b); + + return rv; +} + +static int +bio_dtls_write (BIO *b, const char *in, int inl) +{ + app_session_transport_t at = { 0 }; + svm_msg_q_t *mq; + session_t *s; + int rv; + + if (PREDICT_FALSE (!in)) + return 0; + + s = bio_session (b); + if (!s) + { + clib_warning ("no session"); + errno = EBADFD; + return -1; + } + + mq = session_main_get_vpp_event_queue (s->thread_index); + rv = app_send_dgram_raw (s->tx_fifo, &at, mq, (u8 *) in, inl, + SESSION_IO_EVT_TX, 1 /* do_evt */, 0 /* noblock */); + + if (rv < 0) + { + BIO_set_retry_read (b); + errno = EAGAIN; + return -1; + } + + BIO_clear_retry_flags (b); + + return rv; +} + +static int +dtls_dgram_overhead (BIO *b) +{ + session_t *s = bio_session (b); + if (session_type_is_ip4 (s->session_type)) + /* 20B ip 8B udp */ + return 28; + else + /* 40B ip 8B udp */ + return 48; +} + +static u16 +dtls_dgram_mss (BIO *b) +{ + session_t *s = bio_session (b); + transport_send_params_t sp; + + transport_connection_snd_params (session_get_transport (s), &sp); + + return sp.snd_mss; +} + +long +bio_dtls_ctrl (BIO *b, int cmd, long larg, void *parg) +{ + long ret = 1; + + switch (cmd) + { + case BIO_C_SET_FD: + os_panic (); + break; + case BIO_C_GET_FD: + os_panic (); + break; + case BIO_CTRL_GET_CLOSE: + ret = BIO_get_shutdown (b); + break; + case BIO_CTRL_SET_CLOSE: + BIO_set_shutdown (b, (int) larg); + break; + case BIO_CTRL_PENDING: + case BIO_CTRL_WPENDING: + ret = 0; + break; + case BIO_CTRL_DUP: + case BIO_CTRL_FLUSH: + ret = 1; + break; + case BIO_CTRL_DGRAM_QUERY_MTU: + ret = dtls_dgram_mss (b); + break; + case BIO_CTRL_DGRAM_SET_MTU: + ret = 0; + break; + case BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT: + ret = 0; + break; + case BIO_CTRL_DGRAM_GET_MTU_OVERHEAD: + ret = dtls_dgram_overhead (b); + break; + default: + ret = 0; + break; + } + return ret; +} + +BIO * +BIO_new_dtls (session_handle_t sh) +{ + static BIO_METHOD *dtls_bio_method; + BIO *b; + + if (!dtls_bio_method) + { + dtls_bio_method = BIO_meth_new (BIO_TYPE_SOCKET, "dtls_bio"); + BIO_meth_set_write (dtls_bio_method, bio_dtls_write); + BIO_meth_set_read (dtls_bio_method, bio_dtls_read); + BIO_meth_set_create (dtls_bio_method, bio_dtls_alloc); + BIO_meth_set_destroy (dtls_bio_method, bio_dtls_free); + BIO_meth_set_ctrl (dtls_bio_method, bio_dtls_ctrl); + } + + b = BIO_new (dtls_bio_method); + + /* Initialize the BIO */ + BIO_set_data (b, uword_to_pointer (sh, void *)); + BIO_set_init (b, 1); + + return b; +} + +/* + * fd.io coding-style-patch-verification: ON + * + * Local Variables: + * eval: (c-set-style "gnu") + * End: + */ diff --git a/src/plugins/tlsopenssl/tls_bio.h b/src/plugins/tlsopenssl/tls_bios.h similarity index 95% rename from src/plugins/tlsopenssl/tls_bio.h rename to src/plugins/tlsopenssl/tls_bios.h index b9f3c5384b9..259900ef754 100644 --- a/src/plugins/tlsopenssl/tls_bio.h +++ b/src/plugins/tlsopenssl/tls_bios.h @@ -19,6 +19,7 @@ #include BIO *BIO_new_tls (session_handle_t sh); +BIO *BIO_new_dtls (session_handle_t sh); #endif /* SRC_PLUGINS_TLSOPENSSL_TLS_BIO_H_ */ diff --git a/src/plugins/tlsopenssl/tls_openssl.c b/src/plugins/tlsopenssl/tls_openssl.c index 789c64d88d3..00cd4621897 100644 --- a/src/plugins/tlsopenssl/tls_openssl.c +++ b/src/plugins/tlsopenssl/tls_openssl.c @@ -26,19 +26,19 @@ #include #include #include -#include +#include #define MAX_CRYPTO_LEN 64 openssl_main_t openssl_main; + static u32 -openssl_ctx_alloc (void) +openssl_ctx_alloc_w_thread (u32 thread_index) { - u8 thread_index = vlib_get_thread_index (); - openssl_main_t *tm = &openssl_main; + openssl_main_t *om = &openssl_main; openssl_ctx_t **ctx; - pool_get (tm->ctx_pool[thread_index], ctx); + pool_get (om->ctx_pool[thread_index], ctx); if (!(*ctx)) *ctx = clib_mem_alloc (sizeof (openssl_ctx_t)); @@ -46,10 +46,16 @@ openssl_ctx_alloc (void) (*ctx)->ctx.c_thread_index = thread_index; (*ctx)->ctx.tls_ctx_engine = CRYPTO_ENGINE_OPENSSL; (*ctx)->ctx.app_session_handle = SESSION_INVALID_HANDLE; - (*ctx)->openssl_ctx_index = ctx - tm->ctx_pool[thread_index]; + (*ctx)->openssl_ctx_index = ctx - om->ctx_pool[thread_index]; return ((*ctx)->openssl_ctx_index); } +static u32 +openssl_ctx_alloc (void) +{ + return openssl_ctx_alloc_w_thread (vlib_get_thread_index ()); +} + static void openssl_ctx_free (tls_ctx_t * ctx) { @@ -68,6 +74,40 @@ openssl_ctx_free (tls_ctx_t * ctx) oc->openssl_ctx_index); } +static void * +openssl_ctx_detach (tls_ctx_t *ctx) +{ + openssl_ctx_t *oc = (openssl_ctx_t *) ctx, *oc_copy; + + oc_copy = clib_mem_alloc (sizeof (*oc_copy)); + clib_memcpy (oc_copy, oc, sizeof (*oc)); + + return oc_copy; +} + +static u32 +openssl_ctx_attach (u32 thread_index, void *ctx_ptr) +{ + openssl_main_t *om = &openssl_main; + session_handle_t sh; + openssl_ctx_t **oc; + + pool_get (om->ctx_pool[thread_index], oc); + /* Free the old instance instead of looking for an empty spot */ + if (*oc) + clib_mem_free (*oc); + + *oc = ctx_ptr; + (*oc)->openssl_ctx_index = oc - om->ctx_pool[thread_index]; + (*oc)->ctx.c_thread_index = thread_index; + + sh = (*oc)->ctx.tls_session_handle; + BIO_set_data ((*oc)->rbio, uword_to_pointer (sh, void *)); + BIO_set_data ((*oc)->wbio, uword_to_pointer (sh, void *)); + + return ((*oc)->openssl_ctx_index); +} + tls_ctx_t * openssl_ctx_get (u32 ctx_index) { @@ -310,9 +350,9 @@ openssl_confirm_app_close (tls_ctx_t * ctx) session_transport_closed_notify (&ctx->connection); } -static inline int -openssl_ctx_write (tls_ctx_t * ctx, session_t * app_session, - transport_send_params_t * sp) +static int +openssl_ctx_write_tls (tls_ctx_t *ctx, session_t *app_session, + transport_send_params_t *sp) { openssl_ctx_t *oc = (openssl_ctx_t *) ctx; u32 deq_max, space, enq_buf; @@ -358,8 +398,77 @@ check_tls_fifo: return wrote; } +static int +openssl_ctx_write_dtls (tls_ctx_t *ctx, session_t *app_session, + transport_send_params_t *sp) +{ + openssl_main_t *om = &openssl_main; + openssl_ctx_t *oc = (openssl_ctx_t *) ctx; + session_dgram_pre_hdr_t hdr; + session_t *us; + int wrote, rv; + u32 read = 0, to_deq, dgram_sz; + u8 *buf; + + us = session_get_from_handle (ctx->tls_session_handle); + to_deq = svm_fifo_max_dequeue_cons (app_session->tx_fifo); + buf = om->tx_bufs[ctx->c_thread_index]; + + while (to_deq > 0) + { + /* Peeking only pre-header dgram because the session is connected */ + rv = svm_fifo_peek (app_session->tx_fifo, 0, sizeof (hdr), (u8 *) &hdr); + ASSERT (rv == sizeof (hdr) && hdr.data_length < vec_len (buf)); + ASSERT (to_deq >= hdr.data_length + SESSION_CONN_HDR_LEN); + + dgram_sz = hdr.data_length + SESSION_CONN_HDR_LEN; + if (svm_fifo_max_enqueue_prod (us->tx_fifo) < dgram_sz + TLSO_CTRL_BYTES) + { + svm_fifo_add_want_deq_ntf (us->tx_fifo, SVM_FIFO_WANT_DEQ_NOTIF); + transport_connection_deschedule (&ctx->connection); + sp->flags |= TRANSPORT_SND_F_DESCHED; + goto done; + } + + rv = svm_fifo_peek (app_session->tx_fifo, SESSION_CONN_HDR_LEN, + hdr.data_length, buf); + ASSERT (rv == hdr.data_length); + svm_fifo_dequeue_drop (app_session->tx_fifo, dgram_sz); + + wrote = SSL_write (oc->ssl, buf, rv); + ASSERT (wrote > 0); + + read += rv; + to_deq -= dgram_sz; + } + +done: + + if (svm_fifo_needs_deq_ntf (app_session->tx_fifo, read)) + session_dequeue_notify (app_session); + + if (read) + tls_add_vpp_q_tx_evt (us); + + if (PREDICT_FALSE (ctx->app_closed && + !svm_fifo_max_enqueue_prod (us->rx_fifo))) + openssl_confirm_app_close (ctx); + + return read; +} + +static inline int +openssl_ctx_write (tls_ctx_t *ctx, session_t *app_session, + transport_send_params_t *sp) +{ + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + return openssl_ctx_write_tls (ctx, app_session, sp); + else + return openssl_ctx_write_dtls (ctx, app_session, sp); +} + static inline int -openssl_ctx_read (tls_ctx_t * ctx, session_t * tls_session) +openssl_ctx_read_tls (tls_ctx_t *ctx, session_t *tls_session) { openssl_ctx_t *oc = (openssl_ctx_t *) ctx; session_t *app_session; @@ -387,6 +496,76 @@ openssl_ctx_read (tls_ctx_t * ctx, session_t * tls_session) return wrote; } +static inline int +openssl_ctx_read_dtls (tls_ctx_t *ctx, session_t *us) +{ + openssl_main_t *om = &openssl_main; + openssl_ctx_t *oc = (openssl_ctx_t *) ctx; + session_dgram_hdr_t hdr; + session_t *app_session; + u32 wrote = 0; + int read, rv; + u8 *buf; + + if (PREDICT_FALSE (SSL_in_init (oc->ssl))) + { + u32 us_index = us->session_index; + if (openssl_ctx_handshake_rx (ctx, us) < 0) + return 0; + /* Session pool might grow when allocating the app's session */ + us = session_get (us_index, ctx->c_thread_index); + } + + buf = om->rx_bufs[ctx->c_thread_index]; + app_session = session_get_from_handle (ctx->app_session_handle); + svm_fifo_fill_chunk_list (app_session->rx_fifo); + + while (svm_fifo_max_dequeue_cons (us->rx_fifo) > 0) + { + if (svm_fifo_max_enqueue_prod (app_session->rx_fifo) < DTLSO_MAX_DGRAM) + { + tls_add_vpp_q_builtin_rx_evt (us); + goto done; + } + + read = SSL_read (oc->ssl, buf, vec_len (buf)); + if (PREDICT_FALSE (read <= 0)) + { + if (read < 0) + tls_add_vpp_q_builtin_rx_evt (us); + goto done; + } + wrote += read; + + hdr.data_length = read; + hdr.data_offset = 0; + + svm_fifo_seg_t segs[2] = { { (u8 *) &hdr, sizeof (hdr) }, + { buf, read } }; + + rv = svm_fifo_enqueue_segments (app_session->rx_fifo, segs, 2, + 0 /* allow partial */); + ASSERT (rv > 0); + } + +done: + + /* If handshake just completed, session may still be in accepting state */ + if (app_session->session_state >= SESSION_STATE_READY) + tls_notify_app_enqueue (ctx, app_session); + + return wrote; +} + +static inline int +openssl_ctx_read (tls_ctx_t *ctx, session_t *ts) +{ + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + return openssl_ctx_read_tls (ctx, ts); + else + return openssl_ctx_read_dtls (ctx, ts); +} + static int openssl_ctx_init_client (tls_ctx_t * ctx) { @@ -396,10 +575,11 @@ openssl_ctx_init_client (tls_ctx_t * ctx) const SSL_METHOD *method; int rv, err; - method = SSLv23_client_method (); + method = ctx->tls_type == TRANSPORT_PROTO_TLS ? SSLv23_client_method () : + DTLS_client_method (); if (method == NULL) { - TLS_DBG (1, "SSLv23_method returned null"); + TLS_DBG (1, "(D)TLS_method returned null"); return -1; } @@ -433,8 +613,16 @@ openssl_ctx_init_client (tls_ctx_t * ctx) return -1; } - oc->rbio = BIO_new_tls (ctx->tls_session_handle); - oc->wbio = BIO_new_tls (ctx->tls_session_handle); + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + { + oc->rbio = BIO_new_tls (ctx->tls_session_handle); + oc->wbio = BIO_new_tls (ctx->tls_session_handle); + } + else + { + oc->rbio = BIO_new_dtls (ctx->tls_session_handle); + oc->wbio = BIO_new_dtls (ctx->tls_session_handle); + } SSL_set_bio (oc->ssl, oc->wbio, oc->rbio); SSL_set_connect_state (oc->ssl); @@ -504,7 +692,8 @@ openssl_start_listen (tls_ctx_t * lctx) return -1; } - method = SSLv23_method (); + method = lctx->tls_type == TRANSPORT_PROTO_TLS ? SSLv23_server_method () : + DTLS_server_method (); ssl_ctx = SSL_CTX_new (method); if (!ssl_ctx) { @@ -604,8 +793,16 @@ openssl_ctx_init_server (tls_ctx_t * ctx) return -1; } - oc->rbio = BIO_new_tls (ctx->tls_session_handle); - oc->wbio = BIO_new_tls (ctx->tls_session_handle); + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + { + oc->rbio = BIO_new_tls (ctx->tls_session_handle); + oc->wbio = BIO_new_tls (ctx->tls_session_handle); + } + else + { + oc->rbio = BIO_new_dtls (ctx->tls_session_handle); + oc->wbio = BIO_new_dtls (ctx->tls_session_handle); + } SSL_set_bio (oc->ssl, oc->wbio, oc->rbio); SSL_set_accept_state (oc->ssl); @@ -682,7 +879,10 @@ openssl_app_close (tls_ctx_t * ctx) const static tls_engine_vft_t openssl_engine = { .ctx_alloc = openssl_ctx_alloc, + .ctx_alloc_w_thread = openssl_ctx_alloc_w_thread, .ctx_free = openssl_ctx_free, + .ctx_attach = openssl_ctx_attach, + .ctx_detach = openssl_ctx_detach, .ctx_get = openssl_ctx_get, .ctx_get_w_thread = openssl_ctx_get_w_thread, .ctx_init_server = openssl_ctx_init_server, @@ -771,7 +971,7 @@ tls_openssl_init (vlib_main_t * vm) vlib_thread_main_t *vtm = vlib_get_thread_main (); openssl_main_t *om = &openssl_main; clib_error_t *error = 0; - u32 num_threads; + u32 num_threads, i; error = tls_openssl_api_init (vm); num_threads = 1 /* main thread */ + vtm->n_threads; @@ -786,7 +986,13 @@ tls_openssl_init (vlib_main_t * vm) } vec_validate (om->ctx_pool, num_threads - 1); - + vec_validate (om->rx_bufs, num_threads - 1); + vec_validate (om->tx_bufs, num_threads - 1); + for (i = 0; i < num_threads; i++) + { + vec_validate (om->rx_bufs[i], DTLSO_MAX_DGRAM); + vec_validate (om->tx_bufs[i], DTLSO_MAX_DGRAM); + } tls_register_engine (&openssl_engine, CRYPTO_ENGINE_OPENSSL); om->engine_init = 0; diff --git a/src/plugins/tlsopenssl/tls_openssl.h b/src/plugins/tlsopenssl/tls_openssl.h index 16b256d0ceb..a4beecc8ec1 100644 --- a/src/plugins/tlsopenssl/tls_openssl.h +++ b/src/plugins/tlsopenssl/tls_openssl.h @@ -13,6 +13,9 @@ * limitations under the License. */ +#ifndef SRC_PLUGINS_TLSOPENSSL_TLS_OPENSSL_H_ +#define SRC_PLUGINS_TLSOPENSSL_TLS_OPENSSL_H_ + #include #include #include @@ -24,6 +27,8 @@ #define TLSO_CTRL_BYTES 1000 #define TLSO_MIN_ENQ_SPACE (1 << 16) +#define DTLSO_MAX_DGRAM 2000 + typedef struct tls_ctx_openssl_ { tls_ctx_t ctx; /**< First */ @@ -48,6 +53,9 @@ typedef struct openssl_main_ openssl_ctx_t ***ctx_pool; openssl_listen_ctx_t *lctx_pool; + u8 **rx_bufs; + u8 **tx_bufs; + /* API message ID base */ u16 msg_id_base; @@ -73,6 +81,8 @@ clib_error_t *tls_openssl_api_init (vlib_main_t * vm); int tls_openssl_set_ciphers (char *ciphers); int vpp_openssl_is_inflight (tls_ctx_t * ctx); +#endif /* SRC_PLUGINS_TLSOPENSSL_TLS_OPENSSL_H_ */ + /* * fd.io coding-style-patch-verification: ON * diff --git a/src/vcl/vcl_private.h b/src/vcl/vcl_private.h index 21853ebdc9a..59bb7621e70 100644 --- a/src/vcl/vcl_private.h +++ b/src/vcl/vcl_private.h @@ -542,7 +542,8 @@ static inline u8 vcl_session_has_crypto (vcl_session_t *s) { return (s->session_type == VPPCOM_PROTO_TLS || - s->session_type == VPPCOM_PROTO_QUIC); + s->session_type == VPPCOM_PROTO_QUIC || + s->session_type == VPPCOM_PROTO_DTLS); } static inline u8 @@ -608,7 +609,7 @@ vcl_ip_copy_to_ep (ip46_address_t * ip, vppcom_endpt_t * ep, u8 is_ip4) static inline int vcl_proto_is_dgram (uint8_t proto) { - return proto == VPPCOM_PROTO_UDP; + return proto == VPPCOM_PROTO_UDP || proto == VPPCOM_PROTO_DTLS; } static inline u8 diff --git a/src/vcl/vppcom.c b/src/vcl/vppcom.c index 21892438c37..bc83b55d5d0 100644 --- a/src/vcl/vppcom.c +++ b/src/vcl/vppcom.c @@ -1526,6 +1526,10 @@ vppcom_unformat_proto (uint8_t * proto, char *proto_str) *proto = VPPCOM_PROTO_QUIC; else if (!strcmp (proto_str, "quic")) *proto = VPPCOM_PROTO_QUIC; + else if (!strcmp (proto_str, "DTLS")) + *proto = VPPCOM_PROTO_DTLS; + else if (!strcmp (proto_str, "dtls")) + *proto = VPPCOM_PROTO_DTLS; else return 1; return 0; @@ -3933,6 +3937,9 @@ vppcom_proto_str (vppcom_proto_t proto) case VPPCOM_PROTO_QUIC: proto_str = "QUIC"; break; + case VPPCOM_PROTO_DTLS: + proto_str = "DTLS"; + break; default: proto_str = "UNKNOWN"; break; diff --git a/src/vcl/vppcom.h b/src/vcl/vppcom.h index 6e3c2784db6..1d2fa5df1ba 100644 --- a/src/vcl/vppcom.h +++ b/src/vcl/vppcom.h @@ -45,29 +45,30 @@ extern "C" #define VPPCOM_ENV_VPP_API_SOCKET "VCL_VPP_API_SOCKET" #define VPPCOM_ENV_VPP_SAPI_SOCKET "VCL_VPP_SAPI_SOCKET" -typedef enum -{ - VPPCOM_PROTO_TCP = 0, - VPPCOM_PROTO_UDP, - VPPCOM_PROTO_NONE, - VPPCOM_PROTO_TLS, - VPPCOM_PROTO_QUIC, -} vppcom_proto_t; - -typedef enum -{ - VPPCOM_IS_IP6 = 0, - VPPCOM_IS_IP4, -} vppcom_is_ip4_t; - -typedef struct vppcom_endpt_t_ -{ - uint8_t is_cut_thru; - uint8_t is_ip4; - uint8_t *ip; - uint16_t port; - uint64_t parent_handle; -} vppcom_endpt_t; + typedef enum + { + VPPCOM_PROTO_TCP = 0, + VPPCOM_PROTO_UDP, + VPPCOM_PROTO_NONE, + VPPCOM_PROTO_TLS, + VPPCOM_PROTO_QUIC, + VPPCOM_PROTO_DTLS, + } vppcom_proto_t; + + typedef enum + { + VPPCOM_IS_IP6 = 0, + VPPCOM_IS_IP4, + } vppcom_is_ip4_t; + + typedef struct vppcom_endpt_t_ + { + uint8_t is_cut_thru; + uint8_t is_ip4; + uint8_t *ip; + uint16_t port; + uint64_t parent_handle; + } vppcom_endpt_t; typedef uint32_t vcl_session_handle_t; diff --git a/src/vnet/session/session.c b/src/vnet/session/session.c index 169cca5efe8..85a802c3a06 100644 --- a/src/vnet/session/session.c +++ b/src/vnet/session/session.c @@ -1825,7 +1825,7 @@ session_main_init (vlib_main_t * vm) smm->evt_qs_segment_size = 1 << 20; #endif - smm->last_transport_proto_type = TRANSPORT_PROTO_QUIC; + smm->last_transport_proto_type = TRANSPORT_PROTO_DTLS; return 0; } diff --git a/src/vnet/session/transport_types.h b/src/vnet/session/transport_types.h index 2caafea0fbe..1e7d5672f1c 100644 --- a/src/vnet/session/transport_types.h +++ b/src/vnet/session/transport_types.h @@ -158,12 +158,13 @@ STATIC_ASSERT (STRUCT_OFFSET_OF (transport_connection_t, s_index) STATIC_ASSERT (sizeof (transport_connection_t) <= 128, "moved into 3rd cache line"); -#define foreach_transport_proto \ - _(TCP, "tcp", "T") \ - _(UDP, "udp", "U") \ - _(NONE, "ct", "C") \ - _(TLS, "tls", "J") \ - _(QUIC, "quic", "Q") \ +#define foreach_transport_proto \ + _ (TCP, "tcp", "T") \ + _ (UDP, "udp", "U") \ + _ (NONE, "ct", "C") \ + _ (TLS, "tls", "J") \ + _ (QUIC, "quic", "Q") \ + _ (DTLS, "dtls", "D") typedef enum _transport_proto { diff --git a/src/vnet/tls/tls.c b/src/vnet/tls/tls.c index 59dae88fd1f..6052ca1bf65 100644 --- a/src/vnet/tls/tls.c +++ b/src/vnet/tls/tls.c @@ -221,13 +221,32 @@ tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err) } if (err) - goto failed; + { + /* Free app session pre-allocated when transport was established */ + if (ctx->tls_type == TRANSPORT_PROTO_TLS) + session_free (session_get (ctx->c_s_index, ctx->c_thread_index)); + goto failed; + } + + /* For DTLS the app session is not preallocated because the underlying udp + * session might migrate to a different worker during the handshake */ + if (ctx->tls_type == TRANSPORT_PROTO_DTLS) + { + session_type_t st; + app_session = session_alloc (ctx->c_thread_index); + app_session->session_state = SESSION_STATE_CREATED; + ctx->c_s_index = app_session->session_index; + st = + session_type_from_proto_and_ip (TRANSPORT_PROTO_DTLS, ctx->tcp_is_ip4); + app_session->session_type = st; + app_session->connection_index = ctx->tls_ctx_handle; + } + else + { + app_session = session_get (ctx->c_s_index, ctx->c_thread_index); + } - app_session = session_get (ctx->c_s_index, ctx->c_thread_index); app_session->app_wrk_index = ctx->parent_app_wrk_index; - app_session->connection_index = ctx->tls_ctx_handle; - app_session->session_type = - session_type_from_proto_and_ip (TRANSPORT_PROTO_TLS, ctx->tcp_is_ip4); if ((err = app_worker_init_connected (app_wrk, app_session))) goto failed; @@ -247,8 +266,6 @@ tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err) return 0; failed: - /* Free app session pre-allocated when transport was established */ - session_free (session_get (ctx->c_s_index, ctx->c_thread_index)); ctx->no_app_session = 1; tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ()); return app_worker_connect_notify (app_wrk, 0, err, @@ -278,6 +295,28 @@ tls_ctx_alloc (crypto_engine_type_t engine_type) return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index); } +static inline u32 +tls_ctx_alloc_w_thread (crypto_engine_type_t engine_type, u32 thread_index) +{ + u32 ctx_index; + ctx_index = tls_vfts[engine_type].ctx_alloc_w_thread (thread_index); + return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index); +} + +static inline u32 +tls_ctx_attach (crypto_engine_type_t engine_type, u32 thread_index, void *ctx) +{ + u32 ctx_index; + ctx_index = tls_vfts[engine_type].ctx_attach (thread_index, ctx); + return (((u32) engine_type << TLS_ENGINE_TYPE_SHIFT) | ctx_index); +} + +static inline void * +tls_ctx_detach (tls_ctx_t *ctx) +{ + return tls_vfts[ctx->tls_ctx_engine].ctx_detach (ctx); +} + static inline tls_ctx_t * tls_ctx_get (u32 ctx_handle) { @@ -442,6 +481,10 @@ tls_app_rx_callback (session_t * tls_session) { tls_ctx_t *ctx; + /* DTLS session migrating, wait for next notification */ + if (PREDICT_FALSE (tls_session->flags & SESSION_F_IS_MIGRATING)) + return 0; + ctx = tls_ctx_get (tls_session->opaque); tls_ctx_read (ctx, tls_session); return 0; @@ -459,11 +502,12 @@ tls_app_tx_callback (session_t * tls_session) } int -tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index, - session_t * tls_session, session_error_t err) +tls_session_connected_cb (u32 tls_app_index, u32 ho_ctx_index, + session_t *tls_session, session_error_t err) { session_t *app_session; tls_ctx_t *ho_ctx, *ctx; + session_type_t st; u32 ctx_handle; ho_ctx = tls_ctx_half_open_get (ho_ctx_index); @@ -496,7 +540,7 @@ tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index, ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP; TLS_DBG (1, "TCP connect for %u returned %u. New connection [%u]%x", - ho_ctx_index, is_fail, vlib_get_thread_index (), + ho_ctx_index, err, vlib_get_thread_index (), (ctx) ? ctx_handle : ~0); ctx->tls_session_handle = session_handle (tls_session); @@ -508,10 +552,43 @@ tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index, app_session = session_alloc (ctx->c_thread_index); app_session->session_state = SESSION_STATE_CREATED; ctx->c_s_index = app_session->session_index; + st = session_type_from_proto_and_ip (TRANSPORT_PROTO_TLS, ctx->tcp_is_ip4); + app_session->session_type = st; + app_session->connection_index = ctx->tls_ctx_handle; + + return tls_ctx_init_client (ctx); +} + +int +dtls_session_connected_cb (u32 app_wrk_index, u32 ctx_handle, session_t *us, + session_error_t err) +{ + tls_ctx_t *ctx; + + ctx = tls_ctx_get_w_thread (ctx_handle, 1 /* udp allocs on thread 1 */); + + ctx->tls_session_handle = session_handle (us); + ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP; + us->opaque = ctx_handle; + + /* We don't preallocate the app session because the udp session might + * actually migrate to a different worker at the end of the handshake */ return tls_ctx_init_client (ctx); } +int +tls_session_connected_callback (u32 tls_app_index, u32 ho_ctx_index, + session_t *tls_session, session_error_t err) +{ + if (session_get_transport_proto (tls_session) == TRANSPORT_PROTO_TCP) + return tls_session_connected_cb (tls_app_index, ho_ctx_index, tls_session, + err); + else + return dtls_session_connected_cb (tls_app_index, ho_ctx_index, tls_session, + err); +} + static void tls_app_session_cleanup (session_t * s, session_cleanup_ntf_t ntf) { @@ -531,7 +608,42 @@ tls_app_session_cleanup (session_t * s, session_cleanup_ntf_t ntf) tls_ctx_free (ctx); } -/* *INDENT-OFF* */ +static void +dtls_migrate_udp (void *arg) +{ + tls_ctx_t *ctx = (tls_ctx_t *) arg; + u32 ctx_handle, thread_index; + session_t *us; + + thread_index = session_thread_from_handle (ctx->tls_session_handle); + ASSERT (thread_index == vlib_get_thread_index ()); + + ctx_handle = tls_ctx_attach (ctx->tls_ctx_engine, thread_index, ctx); + ctx = tls_ctx_get_w_thread (ctx_handle, thread_index); + ctx->tls_ctx_handle = ctx_handle; + + us = session_get_from_handle (ctx->tls_session_handle); + us->opaque = ctx_handle; + us->flags &= ~SESSION_F_IS_MIGRATING; + if (svm_fifo_max_dequeue (us->tx_fifo)) + session_send_io_evt_to_thread (us->tx_fifo, SESSION_IO_EVT_TX); +} + +static void +dtls_session_migrate_callback (session_t *us, session_handle_t new_sh) +{ + u32 new_thread = session_thread_from_handle (new_sh); + tls_ctx_t *ctx; + + /* Migrate dtls context to new thread */ + ctx = tls_ctx_get_w_thread (us->opaque, us->thread_index); + ctx->tls_session_handle = new_sh; + ctx = tls_ctx_detach (ctx); + ctx->is_migrated = 1; + + session_send_rpc_evt_to_thread (new_thread, dtls_migrate_udp, (void *) ctx); +} + static session_cb_vft_t tls_app_cb_vft = { .session_accept_callback = tls_session_accept_callback, .session_disconnect_callback = tls_session_disconnect_callback, @@ -541,16 +653,16 @@ static session_cb_vft_t tls_app_cb_vft = { .del_segment_callback = tls_del_segment_callback, .builtin_app_rx_callback = tls_app_rx_callback, .builtin_app_tx_callback = tls_app_tx_callback, + .session_migrate_callback = dtls_session_migrate_callback, .session_cleanup_callback = tls_app_session_cleanup, }; -/* *INDENT-ON* */ int tls_connect (transport_endpoint_cfg_t * tep) { vnet_connect_args_t _cargs = { {}, }, *cargs = &_cargs; - session_endpoint_cfg_t *sep; crypto_engine_type_t engine_type; + session_endpoint_cfg_t *sep; tls_main_t *tm = &tls_main; app_worker_t *app_wrk; application_t *app; @@ -574,6 +686,7 @@ tls_connect (transport_endpoint_cfg_t * tep) ctx->parent_app_api_context = sep->opaque; ctx->tcp_is_ip4 = sep->is_ip4; ctx->ckpair_index = sep->ckpair_index; + ctx->tls_type = sep->transport_proto; if (sep->hostname) { ctx->srv_hostname = format (0, "%v", sep->hostname); @@ -638,6 +751,11 @@ tls_start_listen (u32 app_listener_index, transport_endpoint_t * tep) args->sep_ext = *sep; args->sep_ext.ns_index = app->ns_index; args->sep_ext.transport_proto = TRANSPORT_PROTO_TCP; + if (sep->transport_proto == TRANSPORT_PROTO_DTLS) + { + args->sep_ext.transport_proto = TRANSPORT_PROTO_UDP; + args->sep_ext.transport_flags = TRANSPORT_CFG_F_CONNECTED; + } if (vnet_listen (args)) return -1; @@ -656,6 +774,7 @@ tls_start_listen (u32 app_listener_index, transport_endpoint_t * tep) lctx->tcp_is_ip4 = sep->is_ip4; lctx->tls_ctx_engine = engine_type; lctx->ckpair_index = sep->ckpair_index; + lctx->tls_type = sep->transport_proto; if (tls_vfts[engine_type].ctx_start_listen (lctx)) { @@ -694,7 +813,7 @@ tls_stop_listen (u32 lctx_index) sep.fib_index = lc->fib_index; sep.port = lc->lcl_port; sep.is_ip4 = lc->is_ip4; - sep.transport_proto = TRANSPORT_PROTO_TLS; + sep.transport_proto = lctx->tls_type; clib_memcpy (&sep.ip, &lc->lcl_ip, sizeof (lc->lcl_ip)); session_lookup_del_session_endpoint2 (&sep); @@ -749,13 +868,15 @@ format_tls_ctx (u8 * s, va_list * args) { u32 tcp_si, tcp_ti, ctx_index, ctx_engine; tls_ctx_t *ctx = va_arg (*args, tls_ctx_t *); + char *proto; + proto = ctx->tls_type == TRANSPORT_PROTO_TLS ? "TLS" : "DTLS"; session_parse_handle (ctx->tls_session_handle, &tcp_si, &tcp_ti); tls_ctx_parse_handle (ctx->tls_ctx_handle, &ctx_index, &ctx_engine); - s = format (s, "[%d:%d][TLS] app_wrk %u index %u engine %u tcp %d:%d", - ctx->c_thread_index, ctx->c_s_index, - ctx->parent_app_wrk_index, ctx_index, - ctx_engine, tcp_ti, tcp_si); + s = + format (s, "[%d:%d][%s] app_wrk %u index %u engine %u ts %d:%d", + ctx->c_thread_index, ctx->c_s_index, proto, + ctx->parent_app_wrk_index, ctx_index, ctx_engine, tcp_ti, tcp_si); return s; } @@ -766,13 +887,15 @@ format_tls_listener_ctx (u8 * s, va_list * args) session_t *tls_listener; app_listener_t *al; tls_ctx_t *ctx; + char *proto; ctx = va_arg (*args, tls_ctx_t *); + proto = ctx->tls_type == TRANSPORT_PROTO_TLS ? "TLS" : "DTLS"; al = app_listener_get_w_handle (ctx->tls_session_handle); tls_listener = app_listener_get_session (al); - s = format (s, "[%d:%d][TLS] app_wrk %u engine %u tcp %d:%d", - ctx->c_thread_index, ctx->c_s_index, + s = format (s, "[%d:%d][%s] app_wrk %u engine %u ts %d:%d", + ctx->c_thread_index, ctx->c_s_index, proto, ctx->parent_app_wrk_index, ctx->tls_ctx_engine, tls_listener->thread_index, tls_listener->session_index); @@ -926,7 +1049,6 @@ tls_enable (vlib_main_t * vm, u8 is_en) return 0; } -/* *INDENT-OFF* */ static const transport_proto_vft_t tls_proto = { .enable = tls_enable, .connect = tls_connect, @@ -948,7 +1070,89 @@ static const transport_proto_vft_t tls_proto = { .service_type = TRANSPORT_SERVICE_APP, }, }; -/* *INDENT-ON* */ + +int +dtls_connect (transport_endpoint_cfg_t *tep) +{ + vnet_connect_args_t _cargs = { {}, }, *cargs = &_cargs; + crypto_engine_type_t engine_type; + session_endpoint_cfg_t *sep; + tls_main_t *tm = &tls_main; + app_worker_t *app_wrk; + application_t *app; + tls_ctx_t *ctx; + u32 ctx_handle; + int rv; + + sep = (session_endpoint_cfg_t *) tep; + app_wrk = app_worker_get (sep->app_wrk_index); + app = application_get (app_wrk->app_index); + engine_type = tls_get_engine_type (app->tls_engine); + if (engine_type == CRYPTO_ENGINE_NONE) + { + clib_warning ("No tls engine_type available"); + return -1; + } + + ctx_handle = tls_ctx_alloc_w_thread (engine_type, 1 /* because of udp */); + ctx = tls_ctx_get_w_thread (ctx_handle, 1); + ctx->parent_app_wrk_index = sep->app_wrk_index; + ctx->parent_app_api_context = sep->opaque; + ctx->tcp_is_ip4 = sep->is_ip4; + ctx->ckpair_index = sep->ckpair_index; + ctx->tls_type = sep->transport_proto; + ctx->tls_ctx_handle = ctx_handle; + if (sep->hostname) + { + ctx->srv_hostname = format (0, "%v", sep->hostname); + vec_terminate_c_string (ctx->srv_hostname); + } + + app_worker_alloc_connects_segment_manager (app_wrk); + ctx->tls_ctx_engine = engine_type; + + clib_memcpy_fast (&cargs->sep, sep, sizeof (session_endpoint_t)); + cargs->sep.transport_proto = TRANSPORT_PROTO_UDP; + cargs->app_index = tm->app_index; + cargs->api_context = ctx_handle; + cargs->sep_ext.ns_index = app->ns_index; + cargs->sep_ext.transport_flags = TRANSPORT_CFG_F_CONNECTED; + if ((rv = vnet_connect (cargs))) + return rv; + + TLS_DBG (1, "New DTLS connect request %x engine %d", ctx_handle, + engine_type); + return 0; +} + +static void +dtls_cleanup_callback (u32 ctx_index, u32 thread_index) +{ + /* No op */ +} + +static const transport_proto_vft_t dtls_proto = { + .enable = 0, + .connect = dtls_connect, + .close = tls_disconnect, + .start_listen = tls_start_listen, + .stop_listen = tls_stop_listen, + .get_connection = tls_connection_get, + .get_listener = tls_listener_get, + .custom_tx = tls_custom_tx_callback, + .cleanup = dtls_cleanup_callback, + .format_connection = format_tls_connection, + .format_half_open = format_tls_half_open, + .format_listener = format_tls_listener, + .get_transport_endpoint = tls_transport_endpoint_get, + .get_transport_listener_endpoint = tls_transport_listener_endpoint_get, + .transport_options = { + .name = "dtls", + .short_name = "D", + .tx_type = TRANSPORT_TX_INTERNAL, + .service_type = TRANSPORT_SERVICE_APP, + }, +}; void tls_register_engine (const tls_engine_vft_t * vft, crypto_engine_type_t type) @@ -978,6 +1182,11 @@ tls_init (vlib_main_t * vm) FIB_PROTOCOL_IP4, ~0); transport_register_protocol (TRANSPORT_PROTO_TLS, &tls_proto, FIB_PROTOCOL_IP6, ~0); + + transport_register_protocol (TRANSPORT_PROTO_DTLS, &dtls_proto, + FIB_PROTOCOL_IP4, ~0); + transport_register_protocol (TRANSPORT_PROTO_DTLS, &dtls_proto, + FIB_PROTOCOL_IP6, ~0); return 0; } diff --git a/src/vnet/tls/tls.h b/src/vnet/tls/tls.h index d950fe82629..2038fdff133 100644 --- a/src/vnet/tls/tls.h +++ b/src/vnet/tls/tls.h @@ -21,7 +21,7 @@ #ifndef SRC_VNET_TLS_TLS_H_ #define SRC_VNET_TLS_TLS_H_ -#define TLS_DEBUG 0 +#define TLS_DEBUG 0 #define TLS_DEBUG_LEVEL_CLIENT 0 #define TLS_DEBUG_LEVEL_SERVER 0 @@ -49,6 +49,7 @@ typedef struct tls_cxt_id_ u32 listener_ctx_index; u8 tcp_is_ip4; u8 tls_engine_id; + void *migrate_ctx; } tls_ctx_id_t; /* *INDENT-ON* */ @@ -73,14 +74,17 @@ typedef struct tls_ctx_ /* Temporary storage for session open opaque. Overwritten once * underlying tcp connection is established */ #define parent_app_api_context c_tls_ctx_id.parent_app_api_ctx +#define migration_ctx c_tls_ctx_id.migrate_ctx u8 is_passive_close; u8 resume; u8 app_closed; u8 no_app_session; + u8 is_migrated; u8 *srv_hostname; u32 evt_index; u32 ckpair_index; + transport_proto_t tls_type; } tls_ctx_t; typedef struct tls_main_ @@ -104,7 +108,10 @@ typedef struct tls_main_ typedef struct tls_engine_vft_ { u32 (*ctx_alloc) (void); + u32 (*ctx_alloc_w_thread) (u32 thread_index); void (*ctx_free) (tls_ctx_t * ctx); + void *(*ctx_detach) (tls_ctx_t *ctx); + u32 (*ctx_attach) (u32 thread_index, void *ctx); tls_ctx_t *(*ctx_get) (u32 ctx_index); tls_ctx_t *(*ctx_get_w_thread) (u32 ctx_index, u8 thread_index); int (*ctx_init_client) (tls_ctx_t * ctx); -- 2.16.6