ss: allow dumping kTLS info

[mirror_iproute2.git] / misc / ss.c

diff --git a/misc/ss.c b/misc/ss.c
index 3d9d1d8f7da0daebab56032cee38864cd1fb92ba..c93d72c3f9f58f5df0c1f5f2062bff62bef515f4 100644 (file)
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -51,6 +51,7 @@
 #include <linux/tipc.h>
 #include <linux/tipc_netlink.h>
 #include <linux/tipc_sockets_diag.h>
+#include <linux/tls.h>
 
 /* AF_VSOCK/PF_VSOCK is only provided since glibc 2.18 */
 #ifndef PF_VSOCK
@@ -106,7 +107,6 @@ static int security_get_initial_context(char *name,  char **context)
 }
 #endif
 
-static int resolve_services = 1;
 int preferred_family = AF_UNSPEC;
 static int show_options;
 int show_details;
@@ -121,6 +121,7 @@ static int follow_events;
 static int sctp_ino;
 static int show_tipcinfo;
 static int show_tos;
+int numeric;
 int oneline;
 
 enum col_id {
@@ -1553,7 +1554,7 @@ static const char *resolve_service(int port)
                return buf;
        }
 
-       if (!resolve_services)
+       if (numeric)
                goto do_numeric;
 
        if (dg_proto == RAW_PROTO)
@@ -2361,7 +2362,7 @@ static int proc_inet_split_line(char *line, char **loc, char **rem, char **data)
 
 static char *sprint_bw(char *buf, double bw)
 {
-       if (!resolve_services)
+       if (numeric)
                sprintf(buf, "%.0f", bw);
        else if (bw > 1000000.)
                sprintf(buf, "%.1fM", bw / 1000000.);
@@ -2414,7 +2415,7 @@ static void sctp_stats_print(struct sctp_info *s)
        if (s->sctpi_s_pd_point)
                out(" pdpoint:%d", s->sctpi_s_pd_point);
        if (s->sctpi_s_nodelay)
-               out(" nodealy:%d", s->sctpi_s_nodelay);
+               out(" nodelay:%d", s->sctpi_s_nodelay);
        if (s->sctpi_s_disable_fragments)
                out(" nofrag:%d", s->sctpi_s_disable_fragments);
        if (s->sctpi_s_v4mapped)
@@ -2751,6 +2752,72 @@ static void print_md5sig(struct tcp_diag_md5sig *sig)
        print_escape_buf(sig->tcpm_key, sig->tcpm_keylen, " ,");
 }
 
+static void tcp_tls_version(struct rtattr *attr)
+{
+       u_int16_t val;
+
+       if (!attr)
+               return;
+       val = rta_getattr_u16(attr);
+
+       switch (val) {
+       case TLS_1_2_VERSION:
+               out(" version: 1.2");
+               break;
+       case TLS_1_3_VERSION:
+               out(" version: 1.3");
+               break;
+       default:
+               out(" version: unknown(%hu)", val);
+               break;
+       }
+}
+
+static void tcp_tls_cipher(struct rtattr *attr)
+{
+       u_int16_t val;
+
+       if (!attr)
+               return;
+       val = rta_getattr_u16(attr);
+
+       switch (val) {
+       case TLS_CIPHER_AES_GCM_128:
+               out(" cipher: aes-gcm-128");
+               break;
+       case TLS_CIPHER_AES_GCM_256:
+               out(" cipher: aes-gcm-256");
+               break;
+       }
+}
+
+static void tcp_tls_conf(const char *name, struct rtattr *attr)
+{
+       u_int16_t val;
+
+       if (!attr)
+               return;
+       val = rta_getattr_u16(attr);
+
+       switch (val) {
+       case TLS_CONF_BASE:
+               out(" %s: none", name);
+               break;
+       case TLS_CONF_SW:
+               out(" %s: sw", name);
+               break;
+       case TLS_CONF_HW:
+               out(" %s: hw", name);
+               break;
+       case TLS_CONF_HW_RECORD:
+               out(" %s: hw-record", name);
+               break;
+       default:
+               out(" %s: unknown(%hu)", name, val);
+               break;
+       }
+}
+
 #define TCPI_HAS_OPT(info, opt) !!(info->tcpi_options & (opt))
 
 static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
@@ -2906,6 +2973,28 @@ static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
                        print_md5sig(sig++);
                }
        }
+       if (tb[INET_DIAG_ULP_INFO]) {
+               struct rtattr *ulpinfo[INET_ULP_INFO_MAX + 1] = { 0 };
+
+               parse_rtattr_nested(ulpinfo, INET_ULP_INFO_MAX,
+                                   tb[INET_DIAG_ULP_INFO]);
+
+               if (ulpinfo[INET_ULP_INFO_NAME])
+                       out(" tcp-ulp-%s",
+                           rta_getattr_str(ulpinfo[INET_ULP_INFO_NAME]));
+
+               if (ulpinfo[INET_ULP_INFO_TLS]) {
+                       struct rtattr *tlsinfo[TLS_INFO_MAX + 1] = { 0 };
+
+                       parse_rtattr_nested(tlsinfo, TLS_INFO_MAX,
+                                           ulpinfo[INET_ULP_INFO_TLS]);
+
+                       tcp_tls_version(tlsinfo[TLS_INFO_VERSION]);
+                       tcp_tls_cipher(tlsinfo[TLS_INFO_CIPHER]);
+                       tcp_tls_conf("rxconf", tlsinfo[TLS_INFO_RXCONF]);
+                       tcp_tls_conf("txconf", tlsinfo[TLS_INFO_TXCONF]);
+               }
+       }
 }
 
 static const char *format_host_sa(struct sockaddr_storage *sa)
@@ -2937,7 +3026,7 @@ static void sctp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
                len = RTA_PAYLOAD(tb[INET_DIAG_LOCALS]);
                sa = RTA_DATA(tb[INET_DIAG_LOCALS]);
 
-               out("locals:%s", format_host_sa(sa));
+               out(" locals:%s", format_host_sa(sa));
                for (sa++, len -= sizeof(*sa); len > 0; sa++, len -= sizeof(*sa))
                        out(",%s", format_host_sa(sa));
 
@@ -4298,14 +4387,11 @@ static int netlink_show_one(struct filter *f,
 
        sock_state_print(&st);
 
-       if (resolve_services)
-               prot_name = nl_proto_n2a(prot, prot_buf, sizeof(prot_buf));
-       else
-               prot_name = int_to_str(prot, prot_buf);
+       prot_name = nl_proto_n2a(prot, prot_buf, sizeof(prot_buf));
 
        if (pid == -1) {
                procname[0] = '*';
-       } else if (resolve_services) {
+       } else if (!numeric) {
                int done = 0;
 
                if (!pid) {
@@ -5052,7 +5138,7 @@ int main(int argc, char *argv[])
                                 long_opts, NULL)) != EOF) {
                switch (ch) {
                case 'n':
-                       resolve_services = 0;
+                       numeric = 1;
                        break;
                case 'r':
                        resolve_hosts = 1;
@@ -5270,7 +5356,7 @@ int main(int argc, char *argv[])
        filter_states_set(&current_filter, state_filter);
        filter_merge_defaults(&current_filter);
 
-       if (resolve_services && resolve_hosts &&
+       if (!numeric && resolve_hosts &&
            (current_filter.dbs & (UNIX_DBM|INET_L4_DBM)))
                init_service_resolver();