tls: add counters for rekey

This introduces 5 counters to keep track of key updates:
Tls{Rx,Tx}Rekey{Ok,Error} and TlsRxRekeyReceived.

Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index adf5fd78dd50301889a08ffedc1a59000970174b..51da2e00112de51de9fa5835ae2a514a01c9527c 100644 (file)
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -358,6 +358,11 @@ enum
        LINUX_MIB_TLSRXDEVICERESYNC,            /* TlsRxDeviceResync */
        LINUX_MIB_TLSDECRYPTRETRY,              /* TlsDecryptRetry */
        LINUX_MIB_TLSRXNOPADVIOL,               /* TlsRxNoPadViolation */
+       LINUX_MIB_TLSRXREKEYOK,                 /* TlsRxRekeyOk */
+       LINUX_MIB_TLSRXREKEYERROR,              /* TlsRxRekeyError */
+       LINUX_MIB_TLSTXREKEYOK,                 /* TlsTxRekeyOk */
+       LINUX_MIB_TLSTXREKEYERROR,              /* TlsTxRekeyError */
+       LINUX_MIB_TLSRXREKEYRECEIVED,           /* TlsRxRekeyReceived */
        __LINUX_MIB_TLSMAX
 };
 

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 68b5735dafc1975281769a345c42bc7f70ec81fb..9ee5a83c5b400a9003d3d4988db7d813a61026f4 100644 (file)
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -640,8 +640,11 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
                /* Currently we only support setting crypto info more
                 * than one time for TLS 1.3
                 */
-               if (crypto_info->version != TLS_1_3_VERSION)
+               if (crypto_info->version != TLS_1_3_VERSION) {
+                       TLS_INC_STATS(sock_net(sk), tx ? LINUX_MIB_TLSTXREKEYERROR
+                                                      : LINUX_MIB_TLSRXREKEYERROR);
                        return -EBUSY;
+               }
 
                update = true;
                old_crypto_info = crypto_info;
@@ -696,8 +699,13 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
                                                update ? crypto_info : NULL);
                        if (rc)
                                goto err_crypto_info;
-                       TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSTXSW);
-                       TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSCURRTXSW);
+
+                       if (update) {
+                               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSTXREKEYOK);
+                       } else {
+                               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSTXSW);
+                               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSCURRTXSW);
+                       }
                        conf = TLS_SW;
                }
        } else {
@@ -711,8 +719,13 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
                                                update ? crypto_info : NULL);
                        if (rc)
                                goto err_crypto_info;
-                       TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSRXSW);
-                       TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSCURRRXSW);
+
+                       if (update) {
+                               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSRXREKEYOK);
+                       } else {
+                               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSRXSW);
+                               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSCURRRXSW);
+                       }
                        conf = TLS_SW;
                }
                if (!update)
@@ -735,6 +748,10 @@ static int do_tls_setsockopt_conf(struct sock *sk, sockptr_t optval,
        return 0;
 
 err_crypto_info:
+       if (update) {
+               TLS_INC_STATS(sock_net(sk), tx ? LINUX_MIB_TLSTXREKEYERROR
+                                              : LINUX_MIB_TLSRXREKEYERROR);
+       }
        memzero_explicit(crypto_ctx, sizeof(*crypto_ctx));
        return rc;
 }

diff --git a/net/tls/tls_proc.c b/net/tls/tls_proc.c
index 68982728f62098de174012fb83f1e889c47fee9b..367666aa07b8810e6a9b19c0697610900fa6a7c9 100644 (file)
--- a/net/tls/tls_proc.c
+++ b/net/tls/tls_proc.c
@@ -22,6 +22,11 @@ static const struct snmp_mib tls_mib_list[] = {
        SNMP_MIB_ITEM("TlsRxDeviceResync", LINUX_MIB_TLSRXDEVICERESYNC),
        SNMP_MIB_ITEM("TlsDecryptRetry", LINUX_MIB_TLSDECRYPTRETRY),
        SNMP_MIB_ITEM("TlsRxNoPadViolation", LINUX_MIB_TLSRXNOPADVIOL),
+       SNMP_MIB_ITEM("TlsRxRekeyOk", LINUX_MIB_TLSRXREKEYOK),
+       SNMP_MIB_ITEM("TlsRxRekeyError", LINUX_MIB_TLSRXREKEYERROR),
+       SNMP_MIB_ITEM("TlsTxRekeyOk", LINUX_MIB_TLSTXREKEYOK),
+       SNMP_MIB_ITEM("TlsTxRekeyError", LINUX_MIB_TLSTXREKEYERROR),
+       SNMP_MIB_ITEM("TlsRxRekeyReceived", LINUX_MIB_TLSRXREKEYRECEIVED),
        SNMP_MIB_SENTINEL
 };
 

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 9e5aff5bab98ee1da5db4b7195993bbc8fadc3b7..47550d4858193661030edb8b0bc4df223a6d00f5 100644 (file)
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1724,7 +1724,8 @@ tls_decrypt_device(struct sock *sk, struct msghdr *msg,
        return 1;
 }
 
-static int tls_check_pending_rekey(struct tls_context *ctx, struct sk_buff *skb)
+static int tls_check_pending_rekey(struct sock *sk, struct tls_context *ctx,
+                                  struct sk_buff *skb)
 {
        const struct strp_msg *rxm = strp_msg(skb);
        const struct tls_msg *tlm = tls_msg(skb);
@@ -1747,6 +1748,7 @@ static int tls_check_pending_rekey(struct tls_context *ctx, struct sk_buff *skb)
                struct tls_sw_context_rx *rx_ctx = ctx->priv_ctx_rx;
 
                WRITE_ONCE(rx_ctx->key_update_pending, true);
+               TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSRXREKEYRECEIVED);
        }
 
        return 0;
@@ -1771,7 +1773,7 @@ static int tls_rx_one_record(struct sock *sk, struct msghdr *msg,
        rxm->full_len -= prot->overhead_size;
        tls_advance_record_sn(sk, prot, &tls_ctx->rx);
 
-       return tls_check_pending_rekey(tls_ctx, darg->skb);
+       return tls_check_pending_rekey(sk, tls_ctx, darg->skb);
 }
 
 int decrypt_skb(struct sock *sk, struct scatterlist *sgout)