From 14cadc707b919914e9a2d5dffad9232c3ae97c5f Mon Sep 17 00:00:00 2001 From: Davide Caratti Date: Mon, 7 Oct 2019 12:16:44 +0200 Subject: [PATCH] ss: allow dumping kTLS info now that INET_DIAG_INFO requests can dump TCP ULP information, extend 'ss' to allow diagnosing kTLS when it is attached to a TCP socket. While at it, import kTLS uAPI definitions from the latest net-next tree. CC: Andrea Claudi Co-developed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski Signed-off-by: Davide Caratti Signed-off-by: David Ahern --- misc/ss.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/misc/ss.c b/misc/ss.c index 363b4c8d..c93d72c3 100644 --- a/misc/ss.c +++ b/misc/ss.c @@ -51,6 +51,7 @@ #include #include #include +#include /* AF_VSOCK/PF_VSOCK is only provided since glibc 2.18 */ #ifndef PF_VSOCK @@ -2751,6 +2752,72 @@ static void print_md5sig(struct tcp_diag_md5sig *sig) print_escape_buf(sig->tcpm_key, sig->tcpm_keylen, " ,"); } +static void tcp_tls_version(struct rtattr *attr) +{ + u_int16_t val; + + if (!attr) + return; + val = rta_getattr_u16(attr); + + switch (val) { + case TLS_1_2_VERSION: + out(" version: 1.2"); + break; + case TLS_1_3_VERSION: + out(" version: 1.3"); + break; + default: + out(" version: unknown(%hu)", val); + break; + } +} + +static void tcp_tls_cipher(struct rtattr *attr) +{ + u_int16_t val; + + if (!attr) + return; + val = rta_getattr_u16(attr); + + switch (val) { + case TLS_CIPHER_AES_GCM_128: + out(" cipher: aes-gcm-128"); + break; + case TLS_CIPHER_AES_GCM_256: + out(" cipher: aes-gcm-256"); + break; + } +} + +static void tcp_tls_conf(const char *name, struct rtattr *attr) +{ + u_int16_t val; + + if (!attr) + return; + val = rta_getattr_u16(attr); + + switch (val) { + case TLS_CONF_BASE: + out(" %s: none", name); + break; + case TLS_CONF_SW: + out(" %s: sw", name); + break; + case TLS_CONF_HW: + out(" %s: hw", name); + break; + case TLS_CONF_HW_RECORD: + out(" %s: hw-record", name); + break; + default: + out(" %s: unknown(%hu)", name, val); + break; + } +} + #define TCPI_HAS_OPT(info, opt) !!(info->tcpi_options & (opt)) static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r, @@ -2906,6 +2973,28 @@ static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r, print_md5sig(sig++); } } + if (tb[INET_DIAG_ULP_INFO]) { + struct rtattr *ulpinfo[INET_ULP_INFO_MAX + 1] = { 0 }; + + parse_rtattr_nested(ulpinfo, INET_ULP_INFO_MAX, + tb[INET_DIAG_ULP_INFO]); + + if (ulpinfo[INET_ULP_INFO_NAME]) + out(" tcp-ulp-%s", + rta_getattr_str(ulpinfo[INET_ULP_INFO_NAME])); + + if (ulpinfo[INET_ULP_INFO_TLS]) { + struct rtattr *tlsinfo[TLS_INFO_MAX + 1] = { 0 }; + + parse_rtattr_nested(tlsinfo, TLS_INFO_MAX, + ulpinfo[INET_ULP_INFO_TLS]); + + tcp_tls_version(tlsinfo[TLS_INFO_VERSION]); + tcp_tls_cipher(tlsinfo[TLS_INFO_CIPHER]); + tcp_tls_conf("rxconf", tlsinfo[TLS_INFO_RXCONF]); + tcp_tls_conf("txconf", tlsinfo[TLS_INFO_TXCONF]); + } + } } static const char *format_host_sa(struct sockaddr_storage *sa) -- 2.39.2