ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls svm: prealloc tcp fifo chunks before ssl write

Browse Source 
Type: improvement

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: I7c47b55ec6f0c83f2d13e0e737d0559a32f7c837
This commit is contained in:
Florin Coras
2021-05-19 19:28:40 -07:00
committed by Damjan Marion
parent 05bc33c15d
commit e3c6a54995
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/plugins/tlsopenssl/tls_openssl.c
View File

@ -382,6 +382,13 @@ openssl_ctx_write_tls (tls_ctx_t *ctx, session_t *app_session,
deq_max = clib_min (deq_max, sp->max_burst_size);
/* Make sure tcp's tx fifo can actually buffer all bytes to be dequeued.
* If under memory pressure, tls's fifo segment might not be able to
* allocate the chunks needed. This also avoids errors from the underlying
* custom bio to the ssl infra which at times can get stuck. */
if (svm_fifo_provision_chunks (ts->tx_fifo, 0, 0, deq_max + TLSO_CTRL_BYTES))
goto check_tls_fifo;
wrote = openssl_write_from_fifo_into_ssl (f, oc->ssl, deq_max);
if (!wrote)
goto check_tls_fifo;

3
src/svm/svm_fifo.c
View File

@ -1257,6 +1257,9 @@ svm_fifo_provision_chunks (svm_fifo_t *f, svm_fifo_seg_t *fs, u32 n_segs,
if (n_avail < len && f_try_chunk_alloc (f, head, tail, len))
return SVM_FIFO_EGROW;
if (!fs || !n_segs)
return 0;
c = f_tail_cptr (f);
head_pos = (tail - c->start_byte);
fs[0].data = c->data + head_pos;

4
src/vnet/tls/tls.c
View File

@ -226,7 +226,8 @@ tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err)
/* Free app session pre-allocated when transport was established */
if (ctx->tls_type == TRANSPORT_PROTO_TLS)
session_free (session_get (ctx->c_s_index, ctx->c_thread_index));
goto failed;
ctx->no_app_session = 1;
goto send_reply;
}
/* For DTLS the app session is not preallocated because the underlying udp
@ -271,6 +272,7 @@ tls_notify_app_connected (tls_ctx_t * ctx, session_error_t err)
failed:
ctx->no_app_session = 1;
tls_disconnect (ctx->tls_ctx_handle, vlib_get_thread_index ());
send_reply:
return app_worker_connect_notify (app_wrk, 0, err,
ctx->parent_app_api_context);
}