session: support of multiple extended configs

This allow configuration for each transport protocol when combined,
e.g. HTTPS=HTTP+TLS.
Extended config of session endpoint config is now chunk of memory,
which allow seamless integration with VCL, and internal
representation is hidden behind APIs, which is better for
future improvements. By default chunk is allocated to 512B if the
app doesn't do so before.

Type: improvement
Change-Id: I323f19ec255eba31c58c06b8b83af45aab7f5bb1
Signed-off-by: Matus Fabian <matfabia@cisco.com>

15 files changed, 173 insertions, 64 deletions

diff --git a/src/plugins/hs_apps/echo_client.c b/src/plugins/hs_apps/echo_client.c
index 8dec5d86824..d5edffbd02e 100644
--- a/src/plugins/hs_apps/echo_client.c
+++ b/src/plugins/hs_apps/echo_client.c
@@ -946,15 +946,16 @@ ec_connect_rpc (void *args)
       a->api_context = ci;
       if (needs_crypto)
 	{
-	  session_endpoint_alloc_ext_cfg (&a->sep_ext,
-					  TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-	  a->sep_ext.ext_cfg->crypto.ckpair_index = ecm->ckpair_index;
+	  transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	    &a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	    sizeof (transport_endpt_crypto_cfg_t));
+	  ext_cfg->crypto.ckpair_index = ecm->ckpair_index;
 	}
 
       rv = vnet_connect (a);
 
       if (needs_crypto)
-	clib_mem_free (a->sep_ext.ext_cfg);
+	session_endpoint_free_ext_cfgs (&a->sep_ext);
 
       if (rv)
 	{
diff --git a/src/plugins/hs_apps/echo_server.c b/src/plugins/hs_apps/echo_server.c
index 756a1cc3451..b981e775b57 100644
--- a/src/plugins/hs_apps/echo_server.c
+++ b/src/plugins/hs_apps/echo_server.c
@@ -591,6 +591,7 @@ echo_server_listen ()
   i32 rv;
   echo_server_main_t *esm = &echo_server_main;
   vnet_listen_args_t _args = {}, *args = &_args;
+  int needs_crypto;
 
   if ((rv = parse_uri (esm->server_uri, &args->sep_ext)))
     {
@@ -598,11 +599,14 @@ echo_server_listen ()
     }
   args->app_index = esm->app_index;
   args->sep_ext.port = hs_make_data_port (args->sep_ext.port);
-  if (echo_client_transport_needs_crypto (args->sep_ext.transport_proto))
+  needs_crypto =
+    echo_client_transport_needs_crypto (args->sep_ext.transport_proto);
+  if (needs_crypto)
     {
-      session_endpoint_alloc_ext_cfg (&args->sep_ext,
-				      TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-      args->sep_ext.ext_cfg->crypto.ckpair_index = esm->ckpair_index;
+      transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	&args->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	sizeof (transport_endpt_crypto_cfg_t));
+      ext_cfg->crypto.ckpair_index = esm->ckpair_index;
     }
 
   if (args->sep_ext.transport_proto == TRANSPORT_PROTO_UDP)
@@ -612,8 +616,8 @@ echo_server_listen ()
 
   rv = vnet_listen (args);
   esm->listener_handle = args->handle;
-  if (args->sep_ext.ext_cfg)
-    clib_mem_free (args->sep_ext.ext_cfg);
+  if (needs_crypto)
+    session_endpoint_free_ext_cfgs (&args->sep_ext);
   return rv;
 }
 
diff --git a/src/plugins/hs_apps/http_cli.c b/src/plugins/hs_apps/http_cli.c
index 096c4553a8f..1000a2ddd18 100644
--- a/src/plugins/hs_apps/http_cli.c
+++ b/src/plugins/hs_apps/http_cli.c
@@ -660,9 +660,10 @@ hcs_listen ()
 
   if (need_crypto)
     {
-      session_endpoint_alloc_ext_cfg (&a->sep_ext,
-				      TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-      a->sep_ext.ext_cfg->crypto.ckpair_index = hcm->ckpair_index;
+      transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	&a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	sizeof (transport_endpt_crypto_cfg_t));
+      ext_cfg->crypto.ckpair_index = hcm->ckpair_index;
     }
 
   rv = vnet_listen (a);
@@ -676,7 +677,7 @@ hcs_listen ()
     }
 
   if (need_crypto)
-    clib_mem_free (a->sep_ext.ext_cfg);
+    session_endpoint_free_ext_cfgs (&a->sep_ext);
 
   return rv;
 }
diff --git a/src/plugins/hs_apps/http_tps.c b/src/plugins/hs_apps/http_tps.c
index cdeafa5d54a..a40a31caf63 100644
--- a/src/plugins/hs_apps/http_tps.c
+++ b/src/plugins/hs_apps/http_tps.c
@@ -641,15 +641,16 @@ hts_start_listen (hts_main_t *htm, session_endpoint_cfg_t *sep, u8 *uri,
 
   if (need_crypto)
     {
-      session_endpoint_alloc_ext_cfg (&a->sep_ext,
-				      TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-      a->sep_ext.ext_cfg->crypto.ckpair_index = htm->ckpair_index;
+      transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	&a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	sizeof (transport_endpt_crypto_cfg_t));
+      ext_cfg->crypto.ckpair_index = htm->ckpair_index;
     }
 
   rv = vnet_listen (a);
 
   if (need_crypto)
-    clib_mem_free (a->sep_ext.ext_cfg);
+    session_endpoint_free_ext_cfgs (&a->sep_ext);
 
   if (rv)
     return rv;
diff --git a/src/plugins/hs_apps/proxy.c b/src/plugins/hs_apps/proxy.c
index a2776794c4a..48acaee0ac6 100644
--- a/src/plugins/hs_apps/proxy.c
+++ b/src/plugins/hs_apps/proxy.c
@@ -54,8 +54,7 @@ proxy_do_connect (vnet_connect_args_t *a)
 {
   ASSERT (session_vlib_thread_is_cl_thread ());
   vnet_connect (a);
-  if (a->sep_ext.ext_cfg)
-    clib_mem_free (a->sep_ext.ext_cfg);
+  session_endpoint_free_ext_cfgs (&a->sep_ext);
 }
 
 static void
@@ -487,9 +486,10 @@ proxy_session_start_connect (proxy_session_side_ctx_t *sc, session_t *s)
 
   if (proxy_transport_needs_crypto (a->sep.transport_proto))
     {
-      session_endpoint_alloc_ext_cfg (&a->sep_ext,
-				      TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-      a->sep_ext.ext_cfg->crypto.ckpair_index = pm->ckpair_index;
+      transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	&a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	sizeof (transport_endpt_crypto_cfg_t));
+      ext_cfg->crypto.ckpair_index = pm->ckpair_index;
     }
 
   proxy_program_connect (a);
@@ -895,22 +895,24 @@ proxy_server_listen ()
 {
   proxy_main_t *pm = &proxy_main;
   vnet_listen_args_t _a, *a = &_a;
-  int rv;
+  int rv, need_crypto;
 
   clib_memset (a, 0, sizeof (*a));
 
   a->app_index = pm->server_app_index;
   clib_memcpy (&a->sep_ext, &pm->server_sep, sizeof (pm->server_sep));
-  if (proxy_transport_needs_crypto (a->sep.transport_proto))
+  need_crypto = proxy_transport_needs_crypto (a->sep.transport_proto);
+  if (need_crypto)
     {
-      session_endpoint_alloc_ext_cfg (&a->sep_ext,
-				      TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-      a->sep_ext.ext_cfg->crypto.ckpair_index = pm->ckpair_index;
+      transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	&a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	sizeof (transport_endpt_crypto_cfg_t));
+      ext_cfg->crypto.ckpair_index = pm->ckpair_index;
     }
 
   rv = vnet_listen (a);
-  if (a->sep_ext.ext_cfg)
-    clib_mem_free (a->sep_ext.ext_cfg);
+  if (need_crypto)
+    session_endpoint_free_ext_cfgs (&a->sep_ext);
 
   return rv;
 }
diff --git a/src/plugins/http/http.c b/src/plugins/http/http.c
index cec441d7fcb..6afb80d11c4 100644
--- a/src/plugins/http/http.c
+++ b/src/plugins/http/http.c
@@ -1876,11 +1876,12 @@ http_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep)
   http_main_t *hm = &http_main;
   session_endpoint_cfg_t *sep;
   app_worker_t *app_wrk;
-  transport_proto_t tp;
+  transport_proto_t tp = TRANSPORT_PROTO_TCP;
   app_listener_t *al;
   application_t *app;
   http_conn_t *lhc;
   u32 lhc_index;
+  transport_endpt_ext_cfg_t *ext_cfg;
 
   sep = (session_endpoint_cfg_t *) tep;
 
@@ -1890,7 +1891,10 @@ http_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep)
   args->app_index = hm->app_index;
   args->sep_ext = *sep;
   args->sep_ext.ns_index = app->ns_index;
-  tp = sep->ext_cfg ? TRANSPORT_PROTO_TLS : TRANSPORT_PROTO_TCP;
+
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+  if (ext_cfg)
+    tp = TRANSPORT_PROTO_TLS;
   args->sep_ext.transport_proto = tp;
 
   if (vnet_listen (args))
diff --git a/src/plugins/http_static/static_server.c b/src/plugins/http_static/static_server.c
index 49d1630e843..0b02cc8e682 100644
--- a/src/plugins/http_static/static_server.c
+++ b/src/plugins/http_static/static_server.c
@@ -822,15 +822,16 @@ hss_listen (void)
 
   if (need_crypto)
     {
-      session_endpoint_alloc_ext_cfg (&a->sep_ext,
-				      TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
-      a->sep_ext.ext_cfg->crypto.ckpair_index = hsm->ckpair_index;
+      transport_endpt_ext_cfg_t *ext_cfg = session_endpoint_add_ext_cfg (
+	&a->sep_ext, TRANSPORT_ENDPT_EXT_CFG_CRYPTO,
+	sizeof (transport_endpt_crypto_cfg_t));
+      ext_cfg->crypto.ckpair_index = hsm->ckpair_index;
     }
 
   rv = vnet_listen (a);
 
   if (need_crypto)
-    clib_mem_free (a->sep_ext.ext_cfg);
+    session_endpoint_free_ext_cfgs (&a->sep_ext);
 
   return rv;
 }
diff --git a/src/plugins/quic/quic.c b/src/plugins/quic/quic.c
index 3f7a3426069..3797cd2b4ea 100644
--- a/src/plugins/quic/quic.c
+++ b/src/plugins/quic/quic.c
@@ -1332,14 +1332,16 @@ quic_connect_connection (session_endpoint_cfg_t * sep)
   quic_ctx_t *ctx;
   app_worker_t *app_wrk;
   application_t *app;
+  transport_endpt_ext_cfg_t *ext_cfg;
   int error;
 
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+  if (!ext_cfg)
     return SESSION_E_NOEXTCFG;
 
   /* Use pool on thread 1 if we have workers because of UDP */
   thread_index = transport_cl_thread ();
-  ccfg = &sep->ext_cfg->crypto;
+  ccfg = &ext_cfg->crypto;
 
   clib_memset (cargs, 0, sizeof (*cargs));
   ctx_index = quic_ctx_alloc (thread_index);
@@ -1475,13 +1477,15 @@ quic_start_listen (u32 quic_listen_session_index,
   quic_ctx_t *lctx;
   u32 lctx_index;
   app_listener_t *app_listener;
+  transport_endpt_ext_cfg_t *ext_cfg;
   int rv;
 
   sep = (session_endpoint_cfg_t *) tep;
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+  if (!ext_cfg)
     return SESSION_E_NOEXTCFG;
 
-  ccfg = &sep->ext_cfg->crypto;
+  ccfg = &ext_cfg->crypto;
   app_wrk = app_worker_get (sep->app_wrk_index);
   app = application_get (app_wrk->app_index);
   QUIC_DBG (2, "Called quic_start_listen for app %d", app_wrk->app_index);
diff --git a/src/plugins/srtp/srtp.c b/src/plugins/srtp/srtp.c
index bb54e672918..6862301d2d2 100644
--- a/src/plugins/srtp/srtp.c
+++ b/src/plugins/srtp/srtp.c
@@ -641,10 +641,12 @@ srtp_connect (transport_endpoint_cfg_t *tep)
   application_t *app;
   srtp_tc_t *ctx;
   u32 ctx_index;
+  transport_endpt_ext_cfg_t *ext_cfg;
   int rv;
 
   sep = (session_endpoint_cfg_t *) tep;
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_NONE);
+  if (!ext_cfg)
     return SESSION_E_NOEXTCFG;
 
   app_wrk = app_worker_get (sep->app_wrk_index);
@@ -658,7 +660,7 @@ srtp_connect (transport_endpoint_cfg_t *tep)
   ctx->srtp_ctx_handle = ctx_index;
   ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
 
-  srtp_init_policy (ctx, (transport_endpt_cfg_srtp_t *) sep->ext_cfg->data);
+  srtp_init_policy (ctx, (transport_endpt_cfg_srtp_t *) ext_cfg->data);
 
   clib_memcpy_fast (&cargs->sep, sep, sizeof (session_endpoint_t));
   cargs->sep.transport_proto = TRANSPORT_PROTO_UDP;
@@ -723,9 +725,11 @@ srtp_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep)
   app_listener_t *al;
   srtp_tc_t *lctx;
   u32 lctx_index;
+  transport_endpt_ext_cfg_t *ext_cfg;
 
   sep = (session_endpoint_cfg_t *) tep;
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_NONE);
+  if (!ext_cfg)
     return SESSION_E_NOEXTCFG;
 
   app_wrk = app_worker_get (sep->app_wrk_index);
@@ -756,7 +760,7 @@ srtp_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep)
   lctx->c_s_index = app_listener_index;
   lctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
 
-  srtp_init_policy (lctx, (transport_endpt_cfg_srtp_t *) sep->ext_cfg->data);
+  srtp_init_policy (lctx, (transport_endpt_cfg_srtp_t *) ext_cfg->data);
 
   SRTP_DBG (1, "Started listening %d", lctx_index);
   return lctx_index;
diff --git a/src/vcl/vppcom.c b/src/vcl/vppcom.c
index 1db0a961092..7f3e97ae641 100644
--- a/src/vcl/vppcom.c
+++ b/src/vcl/vppcom.c
@@ -4395,7 +4395,8 @@ vppcom_session_attr (uint32_t session_handle, uint32_t op,
 	  break;
 	}
       vcl_session_alloc_ext_cfg (session, TRANSPORT_ENDPT_EXT_CFG_NONE,
-				 *buflen + sizeof (u32));
+				 *buflen +
+				   TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE);
       clib_memcpy (session->ext_config->data, buffer, *buflen);
       session->ext_config->len = *buflen;
       break;
diff --git a/src/vnet/session/application_interface.h b/src/vnet/session/application_interface.h
index 1702a3727de..0ad4d973bd9 100644
--- a/src/vnet/session/application_interface.h
+++ b/src/vnet/session/application_interface.h
@@ -910,17 +910,65 @@ typedef struct app_sapi_msg_
 } __clib_packed app_sapi_msg_t;
 
 static inline void
-session_endpoint_alloc_ext_cfg (session_endpoint_cfg_t *sep_ext,
-				transport_endpt_ext_cfg_type_t type)
+session_endpoint_init_ext_cfgs (session_endpoint_cfg_t *sep_ext, u32 len)
 {
-  transport_endpt_ext_cfg_t *cfg;
-  u32 cfg_size;
+  sep_ext->ext_cfgs.len = len;
+  sep_ext->ext_cfgs.data = clib_mem_alloc (len);
+  clib_memset (sep_ext->ext_cfgs.data, 0, len);
+}
+
+static inline transport_endpt_ext_cfg_t *
+session_endpoint_add_ext_cfg (session_endpoint_cfg_t *sep_ext,
+			      transport_endpt_ext_cfg_type_t type, u16 len)
+{
+  transport_endpt_ext_cfg_t *ext_cfg;
+
+  if (!sep_ext->ext_cfgs.len)
+    session_endpoint_init_ext_cfgs (sep_ext,
+				    TRANSPORT_ENDPT_EXT_CFGS_CHUNK_SIZE);
+
+  ASSERT (sep_ext->ext_cfgs.tail_offset + len +
+	    TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE <
+	  sep_ext->ext_cfgs.len);
+  ext_cfg = (transport_endpt_ext_cfg_t *) (sep_ext->ext_cfgs.data +
+					   sep_ext->ext_cfgs.tail_offset);
+  ext_cfg->len = len;
+  ext_cfg->type = type;
+  sep_ext->ext_cfgs.tail_offset += len + TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE;
+  return ext_cfg;
+}
+
+static inline transport_endpt_ext_cfg_t *
+session_endpoint_get_ext_cfg (session_endpoint_cfg_t *sep_ext,
+			      transport_endpt_ext_cfg_type_t type)
+{
+  transport_endpt_ext_cfg_t *ext_cfg;
+
+  if (!sep_ext->ext_cfgs.len)
+    return 0;
+
+  ext_cfg = (transport_endpt_ext_cfg_t *) sep_ext->ext_cfgs.data;
+  while ((u8 *) ext_cfg <
+	 sep_ext->ext_cfgs.data + sep_ext->ext_cfgs.tail_offset)
+    {
+      if (ext_cfg->type == type)
+	return ext_cfg;
+      ext_cfg =
+	(transport_endpt_ext_cfg_t *) (sep_ext->ext_cfgs.data + ext_cfg->len +
+				       TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE);
+    }
+  return 0;
+}
 
-  cfg_size = sizeof (transport_endpt_ext_cfg_t);
-  cfg = clib_mem_alloc (cfg_size);
-  clib_memset (cfg, 0, cfg_size);
-  cfg->type = type;
-  sep_ext->ext_cfg = cfg;
+static inline void
+session_endpoint_free_ext_cfgs (session_endpoint_cfg_t *sep_ext)
+{
+  if (!sep_ext->ext_cfgs.len)
+    return;
+  clib_mem_free (sep_ext->ext_cfgs.data);
+  sep_ext->ext_cfgs.len = 0;
+  sep_ext->ext_cfgs.tail_offset = 0;
+  sep_ext->ext_cfgs.data = 0;
 }
 
 #endif /* __included_uri_h__ */
diff --git a/src/vnet/session/session_node.c b/src/vnet/session/session_node.c
index 14b8005d5d0..4d86d409e98 100644
--- a/src/vnet/session/session_node.c
+++ b/src/vnet/session/session_node.c
@@ -136,7 +136,14 @@ session_mq_listen_handler (session_worker_t *wrk, session_evt_elt_t *elt)
   a->sep_ext.transport_flags = mp->flags;
 
   if (mp->ext_config)
-    a->sep_ext.ext_cfg = session_mq_get_ext_config (app, mp->ext_config);
+    {
+      transport_endpt_ext_cfg_t *ext_cfg =
+	session_mq_get_ext_config (app, mp->ext_config);
+      a->sep_ext.ext_cfgs.data = (u8 *) ext_cfg;
+      a->sep_ext.ext_cfgs.len =
+	ext_cfg->len + TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE;
+      a->sep_ext.ext_cfgs.tail_offset = a->sep_ext.ext_cfgs.len;
+    }
 
   if ((rv = vnet_listen (a)))
     session_worker_stat_error_inc (wrk, rv, 1);
@@ -213,7 +220,14 @@ session_mq_connect_one (session_connect_msg_t *mp)
   a->wrk_map_index = mp->wrk_index;
 
   if (mp->ext_config)
-    a->sep_ext.ext_cfg = session_mq_get_ext_config (app, mp->ext_config);
+    {
+      transport_endpt_ext_cfg_t *ext_cfg =
+	session_mq_get_ext_config (app, mp->ext_config);
+      a->sep_ext.ext_cfgs.data = (u8 *) ext_cfg;
+      a->sep_ext.ext_cfgs.len =
+	ext_cfg->len + TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE;
+      a->sep_ext.ext_cfgs.tail_offset = a->sep_ext.ext_cfgs.len;
+    }
 
   if ((rv = vnet_connect (a)))
     {
diff --git a/src/vnet/session/session_types.h b/src/vnet/session/session_types.h
index 683e5378d31..935f8f189ee 100644
--- a/src/vnet/session/session_types.h
+++ b/src/vnet/session/session_types.h
@@ -77,7 +77,7 @@ typedef struct _session_endpoint_cfg
   u8 original_tp;
   u64 parent_handle;
   session_endpoint_cfg_flags_t flags;
-  transport_endpt_ext_cfg_t *ext_cfg;
+  transport_endpt_ext_cfgs_t ext_cfgs;
 } session_endpoint_cfg_t;
 
 #define SESSION_IP46_ZERO			\
@@ -112,7 +112,8 @@ typedef struct _session_endpoint_cfg
     .peer = TRANSPORT_ENDPOINT_NULL, .transport_proto = 0,                    \
     .app_wrk_index = ENDPOINT_INVALID_INDEX,                                  \
     .opaque = ENDPOINT_INVALID_INDEX,                                         \
-    .parent_handle = SESSION_INVALID_HANDLE, .ext_cfg = 0,                    \
+    .parent_handle = SESSION_INVALID_HANDLE,                                  \
+    .ext_cfgs = TRANSPORT_ENDPT_EXT_CFGS_NULL,                                \
   }
 
 #define session_endpoint_to_transport(_sep) ((transport_endpoint_t *)_sep)
diff --git a/src/vnet/session/transport_types.h b/src/vnet/session/transport_types.h
index f6058c6cef6..8ea66142de7 100644
--- a/src/vnet/session/transport_types.h
+++ b/src/vnet/session/transport_types.h
@@ -300,10 +300,27 @@ typedef struct transport_endpt_ext_cfg_
   union
   {
     transport_endpt_crypto_cfg_t crypto;
+    u32 opaque; /**< For general use */
     u8 data[0];
   };
 } transport_endpt_ext_cfg_t;
 
+#define TRANSPORT_ENDPT_EXT_CFG_HEADER_SIZE 4
+
+typedef struct transport_endpt_ext_cfgs_
+{
+  u32 len;	   /**< length of config data chunk */
+  u32 tail_offset; /**< current tail in config data chunk */
+  u8 *data;	   /**< start of config data chunk */
+} transport_endpt_ext_cfgs_t;
+
+#define TRANSPORT_ENDPT_EXT_CFGS_CHUNK_SIZE 512
+
+#define TRANSPORT_ENDPT_EXT_CFGS_NULL                                         \
+  {                                                                           \
+    .len = 0, .tail_offset = 0, .data = 0,                                    \
+  }
+
 typedef clib_bihash_24_8_t transport_endpoint_table_t;
 
 #define ENDPOINT_INVALID_INDEX ((u32)~0)
diff --git a/src/vnet/tls/tls.c b/src/vnet/tls/tls.c
index 8754b67ca31..12dcbb449e8 100644
--- a/src/vnet/tls/tls.c
+++ b/src/vnet/tls/tls.c
@@ -628,16 +628,18 @@ tls_connect (transport_endpoint_cfg_t * tep)
   application_t *app;
   tls_ctx_t *ctx;
   u32 ctx_index;
+  transport_endpt_ext_cfg_t *ext_cfg;
   int rv;
 
   sep = (session_endpoint_cfg_t *) tep;
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+  if (!ext_cfg)
     return SESSION_E_NOEXTCFG;
 
   app_wrk = app_worker_get (sep->app_wrk_index);
   app = application_get (app_wrk->app_index);
 
-  ccfg = &sep->ext_cfg->crypto;
+  ccfg = &ext_cfg->crypto;
   engine_type = tls_get_engine_type (ccfg->crypto_engine, app->tls_engine);
   if (engine_type == CRYPTO_ENGINE_NONE)
     {
@@ -709,16 +711,18 @@ tls_start_listen (u32 app_listener_index, transport_endpoint_cfg_t *tep)
   app_listener_t *al;
   tls_ctx_t *lctx;
   u32 lctx_index;
+  transport_endpt_ext_cfg_t *ext_cfg;
   int rv;
 
   sep = (session_endpoint_cfg_t *) tep;
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+  if (!ext_cfg)
     return SESSION_E_NOEXTCFG;
 
   app_wrk = app_worker_get (sep->app_wrk_index);
   app = application_get (app_wrk->app_index);
 
-  ccfg = &sep->ext_cfg->crypto;
+  ccfg = &ext_cfg->crypto;
   engine_type = tls_get_engine_type (ccfg->crypto_engine, app->tls_engine);
   if (engine_type == CRYPTO_ENGINE_NONE)
     {
@@ -1115,16 +1119,18 @@ dtls_connect (transport_endpoint_cfg_t *tep)
   application_t *app;
   tls_ctx_t *ctx;
   u32 ctx_handle;
+  transport_endpt_ext_cfg_t *ext_cfg;
   int rv;
 
   sep = (session_endpoint_cfg_t *) tep;
-  if (!sep->ext_cfg)
+  ext_cfg = session_endpoint_get_ext_cfg (sep, TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+  if (!ext_cfg)
     return -1;
 
   app_wrk = app_worker_get (sep->app_wrk_index);
   app = application_get (app_wrk->app_index);
 
-  ccfg = &sep->ext_cfg->crypto;
+  ccfg = &ext_cfg->crypto;
   engine_type = tls_get_engine_type (ccfg->crypto_engine, app->tls_engine);
   if (engine_type == CRYPTO_ENGINE_NONE)
     {