summaryrefslogtreecommitdiffstats
path: root/src/plugins
diff options
context:
space:
mode:
authorFlorin Coras <fcoras@cisco.com>2021-04-21 09:05:56 -0700
committerFlorin Coras <florin.coras@gmail.com>2021-04-22 16:07:11 +0000
commita54b62d77794dee48510e7c128d3ab2fc90934b3 (patch)
tree019fb22c41ccf585c6a99bb778dc291f672abdc1 /src/plugins
parentc7e7819ad5c152168a5f1a217c3b72043fd48797 (diff)
vcl session: refactor passing of crypto context
Pass tls/quic crypto context using extended config instead of bloating conect/listen messages. Type: refactor Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: I0bc637ae310e6c31ef1e16847501dcb81453ee94
Diffstat (limited to 'src/plugins')
-rw-r--r--src/plugins/hs_apps/echo_client.c19
-rw-r--r--src/plugins/hs_apps/echo_server.c16
-rw-r--r--src/plugins/hs_apps/http_server.c20
-rw-r--r--src/plugins/hs_apps/proxy.c34
-rw-r--r--src/plugins/hs_apps/sapi/vpp_echo_bapi.c61
-rw-r--r--src/plugins/hs_apps/sapi/vpp_echo_common.h3
-rw-r--r--src/plugins/http_static/static_server.c20
-rw-r--r--src/plugins/quic/quic.c23
8 files changed, 176 insertions, 20 deletions
diff --git a/src/plugins/hs_apps/echo_client.c b/src/plugins/hs_apps/echo_client.c
index 4680ae2f8d1..d641a9ec14e 100644
--- a/src/plugins/hs_apps/echo_client.c
+++ b/src/plugins/hs_apps/echo_client.c
@@ -718,6 +718,13 @@ echo_clients_start_tx_pthread (echo_client_main_t * ecm)
return 0;
}
+static int
+echo_client_transport_needs_crypto (transport_proto_t proto)
+{
+ return proto == TRANSPORT_PROTO_TLS || proto == TRANSPORT_PROTO_DTLS ||
+ proto == TRANSPORT_PROTO_QUIC;
+}
+
clib_error_t *
echo_clients_connect (vlib_main_t * vm, u32 n_clients)
{
@@ -736,10 +743,18 @@ echo_clients_connect (vlib_main_t * vm, u32 n_clients)
clib_memcpy (&a->sep_ext, &sep, sizeof (sep));
a->api_context = i;
a->app_index = ecm->app_index;
- a->sep_ext.ckpair_index = ecm->ckpair_index;
+ if (echo_client_transport_needs_crypto (a->sep_ext.transport_proto))
+ {
+ session_endpoint_alloc_ext_cfg (&a->sep_ext,
+ TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+ a->sep_ext.ext_cfg->crypto.ckpair_index = ecm->ckpair_index;
+ }
vlib_worker_thread_barrier_sync (vm);
- if ((rv = vnet_connect (a)))
+ rv = vnet_connect (a);
+ if (a->sep_ext.ext_cfg)
+ clib_mem_free (a->sep_ext.ext_cfg);
+ if (rv)
{
vlib_worker_thread_barrier_release (vm);
return clib_error_return (0, "connect returned: %d", rv);
diff --git a/src/plugins/hs_apps/echo_server.c b/src/plugins/hs_apps/echo_server.c
index 63150d5a8d8..b75a3667e83 100644
--- a/src/plugins/hs_apps/echo_server.c
+++ b/src/plugins/hs_apps/echo_server.c
@@ -385,6 +385,13 @@ echo_server_detach (void)
}
static int
+echo_client_transport_needs_crypto (transport_proto_t proto)
+{
+ return proto == TRANSPORT_PROTO_TLS || proto == TRANSPORT_PROTO_DTLS ||
+ proto == TRANSPORT_PROTO_QUIC;
+}
+
+static int
echo_server_listen ()
{
i32 rv;
@@ -398,7 +405,12 @@ echo_server_listen ()
return -1;
}
args->app_index = esm->app_index;
- args->sep_ext.ckpair_index = esm->ckpair_index;
+ if (echo_client_transport_needs_crypto (args->sep_ext.transport_proto))
+ {
+ session_endpoint_alloc_ext_cfg (&args->sep_ext,
+ TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+ args->sep_ext.ext_cfg->crypto.ckpair_index = esm->ckpair_index;
+ }
if (args->sep_ext.transport_proto == TRANSPORT_PROTO_UDP)
{
@@ -407,6 +419,8 @@ echo_server_listen ()
rv = vnet_listen (args);
esm->listener_handle = args->handle;
+ if (args->sep_ext.ext_cfg)
+ clib_mem_free (args->sep_ext.ext_cfg);
return rv;
}
diff --git a/src/plugins/hs_apps/http_server.c b/src/plugins/hs_apps/http_server.c
index 72e3f3230b1..34892b6bd4d 100644
--- a/src/plugins/hs_apps/http_server.c
+++ b/src/plugins/hs_apps/http_server.c
@@ -760,12 +760,20 @@ http_server_attach ()
}
static int
+http_transport_needs_crypto (transport_proto_t proto)
+{
+ return proto == TRANSPORT_PROTO_TLS || proto == TRANSPORT_PROTO_DTLS ||
+ proto == TRANSPORT_PROTO_QUIC;
+}
+
+static int
http_server_listen ()
{
session_endpoint_cfg_t sep = SESSION_ENDPOINT_CFG_NULL;
http_server_main_t *hsm = &http_server_main;
vnet_listen_args_t _a, *a = &_a;
char *uri = "tcp://0.0.0.0/80";
+ int rv;
clib_memset (a, 0, sizeof (*a));
a->app_index = hsm->app_index;
@@ -777,9 +785,17 @@ http_server_listen ()
return -1;
clib_memcpy (&a->sep_ext, &sep, sizeof (sep));
- a->sep_ext.ckpair_index = hsm->ckpair_index;
+ if (http_transport_needs_crypto (a->sep_ext.transport_proto))
+ {
+ session_endpoint_alloc_ext_cfg (&a->sep_ext,
+ TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+ a->sep_ext.ext_cfg->crypto.ckpair_index = hsm->ckpair_index;
+ }
- return vnet_listen (a);
+ rv = vnet_listen (a);
+ if (a->sep_ext.ext_cfg)
+ clib_mem_free (a->sep_ext.ext_cfg);
+ return rv;
}
static void
diff --git a/src/plugins/hs_apps/proxy.c b/src/plugins/hs_apps/proxy.c
index 000815813ce..1a49a0f1f3a 100644
--- a/src/plugins/hs_apps/proxy.c
+++ b/src/plugins/hs_apps/proxy.c
@@ -42,6 +42,8 @@ proxy_cb_fn (void *data, u32 data_len)
a.app_index = pa->app_index;
clib_memcpy (&a.sep_ext, &pa->sep, sizeof (pa->sep));
vnet_connect (&a);
+ if (a.sep_ext.ext_cfg)
+ clib_mem_free (a.sep_ext.ext_cfg);
}
static void
@@ -50,6 +52,8 @@ proxy_call_main_thread (vnet_connect_args_t * a)
if (vlib_get_thread_index () == 0)
{
vnet_connect (a);
+ if (a->sep_ext.ext_cfg)
+ clib_mem_free (a->sep_ext.ext_cfg);
}
else
{
@@ -283,6 +287,12 @@ proxy_add_segment_callback (u32 client_index, u64 segment_handle)
}
static int
+proxy_transport_needs_crypto (transport_proto_t proto)
+{
+ return proto == TRANSPORT_PROTO_TLS;
+}
+
+static int
proxy_rx_callback (session_t * s)
{
proxy_main_t *pm = &proxy_main;
@@ -353,9 +363,16 @@ proxy_rx_callback (session_t * s)
clib_spinlock_unlock_if_init (&pm->sessions_lock);
clib_memcpy (&a->sep_ext, &pm->client_sep, sizeof (pm->client_sep));
- a->sep_ext.ckpair_index = pm->ckpair_index;
a->api_context = proxy_index;
a->app_index = pm->active_open_app_index;
+
+ if (proxy_transport_needs_crypto (a->sep.transport_proto))
+ {
+ session_endpoint_alloc_ext_cfg (&a->sep_ext,
+ TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+ a->sep_ext.ext_cfg->crypto.ckpair_index = pm->ckpair_index;
+ }
+
proxy_call_main_thread (a);
}
@@ -697,13 +714,24 @@ proxy_server_listen ()
{
proxy_main_t *pm = &proxy_main;
vnet_listen_args_t _a, *a = &_a;
+ int rv;
+
clib_memset (a, 0, sizeof (*a));
a->app_index = pm->server_app_index;
clib_memcpy (&a->sep_ext, &pm->server_sep, sizeof (pm->server_sep));
- a->sep_ext.ckpair_index = pm->ckpair_index;
+ if (proxy_transport_needs_crypto (a->sep.transport_proto))
+ {
+ session_endpoint_alloc_ext_cfg (&a->sep_ext,
+ TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+ a->sep_ext.ext_cfg->crypto.ckpair_index = pm->ckpair_index;
+ }
+
+ rv = vnet_listen (a);
+ if (a->sep_ext.ext_cfg)
+ clib_mem_free (a->sep_ext.ext_cfg);
- return vnet_listen (a);
+ return rv;
}
static void
diff --git a/src/plugins/hs_apps/sapi/vpp_echo_bapi.c b/src/plugins/hs_apps/sapi/vpp_echo_bapi.c
index 0a0168b070e..7cf15eb1486 100644
--- a/src/plugins/hs_apps/sapi/vpp_echo_bapi.c
+++ b/src/plugins/hs_apps/sapi/vpp_echo_bapi.c
@@ -100,6 +100,31 @@ echo_send_del_cert_key (echo_main_t * em)
vl_msg_api_send_shmem (em->vl_input_queue, (u8 *) & bmp);
}
+static u8
+echo_transport_needs_crypto (transport_proto_t proto)
+{
+ return proto == TRANSPORT_PROTO_TLS || proto == TRANSPORT_PROTO_DTLS ||
+ proto == TRANSPORT_PROTO_QUIC;
+}
+
+static void
+echo_msg_add_crypto_ext_config (echo_main_t *em, uword *offset)
+{
+ transport_endpt_ext_cfg_t cfg;
+ svm_fifo_chunk_t *c;
+
+ c = echo_segment_alloc_chunk (ECHO_MQ_SEG_HANDLE, 0, sizeof (cfg), offset);
+ if (!c)
+ return;
+
+ memset (&cfg, 0, sizeof (cfg));
+ cfg.type = TRANSPORT_ENDPT_EXT_CFG_CRYPTO;
+ cfg.len = sizeof (cfg);
+ cfg.crypto.ckpair_index = em->ckpair_index;
+ cfg.crypto.crypto_engine = em->crypto_engine;
+ clib_memcpy_fast (c->data, &cfg, cfg.len);
+}
+
void
echo_send_listen (echo_main_t * em, ip46_address_t * ip)
{
@@ -117,8 +142,8 @@ echo_send_listen (echo_main_t * em, ip46_address_t * ip)
clib_memcpy_fast (&mp->ip, ip, sizeof (mp->ip));
mp->port = em->uri_elts.port;
mp->proto = em->uri_elts.transport_proto;
- mp->ckpair_index = em->ckpair_index;
- mp->crypto_engine = em->crypto_engine;
+ if (echo_transport_needs_crypto (mp->proto))
+ echo_msg_add_crypto_ext_config (em, &mp->ext_config);
app_send_ctrl_evt_to_vpp (mq, app_evt);
}
@@ -163,8 +188,8 @@ echo_send_connect (echo_main_t * em, void *args)
mp->port = em->uri_elts.port;
mp->proto = em->uri_elts.transport_proto;
mp->parent_handle = a->parent_session_handle;
- mp->ckpair_index = em->ckpair_index;
- mp->crypto_engine = em->crypto_engine;
+ if (echo_transport_needs_crypto (mp->proto))
+ echo_msg_add_crypto_ext_config (em, &mp->ext_config);
mp->flags = em->connect_flag;
app_send_ctrl_evt_to_vpp (mq, app_evt);
}
@@ -332,6 +357,34 @@ echo_segment_attach_mq (uword segment_handle, uword mq_offset, u32 mq_index,
return 0;
}
+svm_fifo_chunk_t *
+echo_segment_alloc_chunk (uword segment_handle, u32 slice_index, u32 size,
+ uword *offset)
+{
+ echo_main_t *em = &echo_main;
+ svm_fifo_chunk_t *c;
+ fifo_segment_t *fs;
+ u32 fs_index;
+
+ fs_index = echo_segment_lookup (segment_handle);
+ if (fs_index == (u32) ~0)
+ {
+ ECHO_LOG (0, "ERROR: mq segment %lx for is not attached!",
+ segment_handle);
+ return 0;
+ }
+
+ clib_spinlock_lock (&em->segment_handles_lock);
+
+ fs = fifo_segment_get_segment (&em->segment_main, fs_index);
+ c = fifo_segment_alloc_chunk_w_slice (fs, slice_index, size);
+ *offset = fifo_segment_chunk_offset (fs, c);
+
+ clib_spinlock_unlock (&em->segment_handles_lock);
+
+ return c;
+}
+
/*
*
* Binary API callbacks
diff --git a/src/plugins/hs_apps/sapi/vpp_echo_common.h b/src/plugins/hs_apps/sapi/vpp_echo_common.h
index dc5f7dfb9b5..4760f3b06e3 100644
--- a/src/plugins/hs_apps/sapi/vpp_echo_common.h
+++ b/src/plugins/hs_apps/sapi/vpp_echo_common.h
@@ -448,6 +448,9 @@ int echo_attach_session (uword segment_handle, uword rxf_offset,
uword mq_offset, uword txf_offset, echo_session_t *s);
int echo_segment_attach_mq (uword segment_handle, uword mq_offset,
u32 mq_index, svm_msg_q_t **mq);
+svm_fifo_chunk_t *echo_segment_alloc_chunk (uword segment_handle,
+ u32 slice_index, u32 size,
+ uword *offset);
/* Binary API */
diff --git a/src/plugins/http_static/static_server.c b/src/plugins/http_static/static_server.c
index b354666f816..23860b083d8 100644
--- a/src/plugins/http_static/static_server.c
+++ b/src/plugins/http_static/static_server.c
@@ -1186,12 +1186,20 @@ http_static_server_attach ()
}
static int
+http_static_transport_needs_crypto (transport_proto_t proto)
+{
+ return proto == TRANSPORT_PROTO_TLS || proto == TRANSPORT_PROTO_DTLS ||
+ proto == TRANSPORT_PROTO_QUIC;
+}
+
+static int
http_static_server_listen ()
{
http_static_server_main_t *hsm = &http_static_server_main;
session_endpoint_cfg_t sep = SESSION_ENDPOINT_CFG_NULL;
vnet_listen_args_t _a, *a = &_a;
char *uri = "tcp://0.0.0.0/80";
+ int rv;
clib_memset (a, 0, sizeof (*a));
a->app_index = hsm->app_index;
@@ -1203,9 +1211,17 @@ http_static_server_listen ()
return -1;
clib_memcpy (&a->sep_ext, &sep, sizeof (sep));
- a->sep_ext.ckpair_index = hsm->ckpair_index;
+ if (http_static_transport_needs_crypto (a->sep_ext.transport_proto))
+ {
+ session_endpoint_alloc_ext_cfg (&a->sep_ext,
+ TRANSPORT_ENDPT_EXT_CFG_CRYPTO);
+ a->sep_ext.ext_cfg->crypto.ckpair_index = hsm->ckpair_index;
+ }
- return vnet_listen (a);
+ rv = vnet_listen (a);
+ if (a->sep_ext.ext_cfg)
+ clib_mem_free (a->sep_ext.ext_cfg);
+ return rv;
}
static void
diff --git a/src/plugins/quic/quic.c b/src/plugins/quic/quic.c
index cf4d1470ffd..cf697278cb7 100644
--- a/src/plugins/quic/quic.c
+++ b/src/plugins/quic/quic.c
@@ -1304,6 +1304,7 @@ static int
quic_connect_connection (session_endpoint_cfg_t * sep)
{
vnet_connect_args_t _cargs, *cargs = &_cargs;
+ transport_endpt_crypto_cfg_t *ccfg;
quic_main_t *qm = &quic_main;
quic_ctx_t *ctx;
app_worker_t *app_wrk;
@@ -1312,6 +1313,11 @@ quic_connect_connection (session_endpoint_cfg_t * sep)
u32 thread_index = vlib_get_thread_index ();
int error;
+ if (!sep->ext_cfg)
+ return -1;
+
+ ccfg = &sep->ext_cfg->crypto;
+
clib_memset (cargs, 0, sizeof (*cargs));
ctx_index = quic_ctx_alloc (thread_index);
ctx = quic_ctx_get (ctx_index, thread_index);
@@ -1323,8 +1329,8 @@ quic_connect_connection (session_endpoint_cfg_t * sep)
ctx->conn_state = QUIC_CONN_STATE_HANDSHAKE;
ctx->client_opaque = sep->opaque;
ctx->c_flags |= TRANSPORT_CONNECTION_F_NO_LOOKUP;
- if (sep->hostname)
- ctx->srv_hostname = format (0, "%v", sep->hostname);
+ if (ccfg->hostname[0])
+ ctx->srv_hostname = format (0, "%s", ccfg->hostname);
else
/* needed by quic for crypto + determining client / server */
ctx->srv_hostname = format (0, "%U", format_ip46_address,
@@ -1342,8 +1348,8 @@ quic_connect_connection (session_endpoint_cfg_t * sep)
cargs->sep_ext.ns_index = app->ns_index;
cargs->sep_ext.transport_flags = TRANSPORT_CFG_F_CONNECTED;
- ctx->crypto_engine = sep->crypto_engine;
- ctx->ckpair_index = sep->ckpair_index;
+ ctx->crypto_engine = ccfg->crypto_engine;
+ ctx->ckpair_index = ccfg->ckpair_index;
if ((error = quic_acquire_crypto_context (ctx)))
return error;
@@ -1435,6 +1441,7 @@ static u32
quic_start_listen (u32 quic_listen_session_index, transport_endpoint_t * tep)
{
vnet_listen_args_t _bargs, *args = &_bargs;
+ transport_endpt_crypto_cfg_t *ccfg;
quic_main_t *qm = &quic_main;
session_handle_t udp_handle;
session_endpoint_cfg_t *sep;
@@ -1447,6 +1454,10 @@ quic_start_listen (u32 quic_listen_session_index, transport_endpoint_t * tep)
int rv;
sep = (session_endpoint_cfg_t *) tep;
+ if (!sep->ext_cfg)
+ return -1;
+
+ ccfg = &sep->ext_cfg->crypto;
app_wrk = app_worker_get (sep->app_wrk_index);
/* We need to call this because we call app_worker_init_connected in
* quic_accept_stream, which assumes the connect segment manager exists */
@@ -1483,8 +1494,8 @@ quic_start_listen (u32 quic_listen_session_index, transport_endpoint_t * tep)
lctx->parent_app_id = app_wrk->app_index;
lctx->udp_session_handle = udp_handle;
lctx->c_s_index = quic_listen_session_index;
- lctx->crypto_engine = sep->crypto_engine;
- lctx->ckpair_index = sep->ckpair_index;
+ lctx->crypto_engine = ccfg->crypto_engine;
+ lctx->ckpair_index = ccfg->ckpair_index;
if (quic_acquire_crypto_context (lctx))
return -1;