Commit 128d23c3 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'net-tls-add-ctrl-path-tracing-and-statistics' 



Jakub Kicinski says:

====================
net/tls: add ctrl path tracing and statistics

This set adds trace events related to TLS offload and basic MIB stats
for TLS.

First patch contains the TLS offload related trace points. Those are
helpful in troubleshooting offload issues, especially around the
resync paths.

Second patch adds a tracepoint to the fastpath of device offload,
it's separated out in case there will be objections to adding
fast path tracepoints. Again, it's quite useful for debugging
offload issues.

Next four patches add MIB statistics. The statistics are implemented
as per-cpu per-netns counters. Since there are currently no fast path
statistics we could move to atomic variables. Per-CPU seem more common.

Most basic statistics are number of created and live sessions, broken
out to offloaded and non-offloaded. Users seem to like those a lot.

Next there is a statistic for decryption errors. These are primarily
useful for device offload debug, in normal deployments decryption
errors should not be common.

Last but not least a counter for device RX resync.
====================

Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 6f4c930e a4d26fdb

Documentation/networking/tls.rst

+26 −0
Original line number Diff line number Diff line
@@ -213,3 +213,29 @@ A patchset to OpenSSL to use ktls as the record layer is 
of calling send directly after a handshake using gnutls.

Since it doesn't implement a full record layer, control

messages are not supported.



Statistics

==========



TLS implementation exposes the following per-namespace statistics

(``/proc/net/tls_stat``):



- ``TlsCurrTxSw``, ``TlsCurrRxSw`` -

  number of TX and RX sessions currently installed where host handles

  cryptography



- ``TlsCurrTxDevice``, ``TlsCurrRxDevice`` -

  number of TX and RX sessions currently installed where NIC handles

  cryptography



- ``TlsTxSw``, ``TlsRxSw`` -

  number of TX and RX sessions opened with host cryptography



- ``TlsTxDevice``, ``TlsRxDevice`` -

  number of TX and RX sessions opened with NIC cryptography



- ``TlsDecryptError`` -

  record decryption failed (e.g. due to incorrect authentication tag)



- ``TlsDeviceRxResync`` -

  number of RX resyncs sent to NICs handling cryptography

drivers/net/ethernet/netronome/nfp/nfp_net_common.c

+2 −1
Original line number Diff line number Diff line
@@ -872,7 +872,8 @@ nfp_net_tls_tx(struct nfp_net_dp *dp, struct nfp_net_r_vector *r_vec, 


		/* jump forward, a TX may have gotten lost, need to sync TX */

		if (!resync_pending && seq - ntls->next_seq < U32_MAX / 4)

			tls_offload_tx_resync_request(nskb->sk);

			tls_offload_tx_resync_request(nskb->sk, seq,

						      ntls->next_seq);



		*nr_frags = 0;

		return nskb;

include/net/netns/mib.h

+3 −0
Original line number Diff line number Diff line
@@ -24,6 +24,9 @@ struct netns_mib { 
#ifdef CONFIG_XFRM_STATISTICS

	DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics);

#endif

#if IS_ENABLED(CONFIG_TLS)

	DEFINE_SNMP_STAT(struct linux_tls_mib, tls_statistics);

#endif

};



#endif

include/net/snmp.h

+6 −0
Original line number Diff line number Diff line
@@ -111,6 +111,12 @@ struct linux_xfrm_mib { 
	unsigned long	mibs[LINUX_MIB_XFRMMAX];

};



/* Linux TLS */

#define LINUX_MIB_TLSMAX	__LINUX_MIB_TLSMAX

struct linux_tls_mib {

	unsigned long	mibs[LINUX_MIB_TLSMAX];

};



#define DEFINE_SNMP_STAT(type, name)	\

	__typeof__(type) __percpu *name

#define DEFINE_SNMP_STAT_ATOMIC(type, name)	\

include/net/tls.h

+14 −7
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ 
#include <linux/netdevice.h>

#include <linux/rcupdate.h>



#include <net/net_namespace.h>

#include <net/tcp.h>

#include <net/strparser.h>

#include <crypto/aead.h>
@@ -73,6 +74,15 @@ 
 */

#define TLS_AES_CCM_IV_B0_BYTE		2



#define __TLS_INC_STATS(net, field)				\

	__SNMP_INC_STATS((net)->mib.tls_statistics, field)

#define TLS_INC_STATS(net, field)				\

	SNMP_INC_STATS((net)->mib.tls_statistics, field)

#define __TLS_DEC_STATS(net, field)				\

	__SNMP_DEC_STATS((net)->mib.tls_statistics, field)

#define TLS_DEC_STATS(net, field)				\

	SNMP_DEC_STATS((net)->mib.tls_statistics, field)



enum {

	TLS_BASE,

	TLS_SW,
@@ -594,13 +604,6 @@ tls_offload_rx_resync_set_type(struct sock *sk, enum tls_offload_sync_type type) 
	tls_offload_ctx_rx(tls_ctx)->resync_type = type;

}



static inline void tls_offload_tx_resync_request(struct sock *sk)

{

	struct tls_context *tls_ctx = tls_get_ctx(sk);



	WARN_ON(test_and_set_bit(TLS_TX_SYNC_SCHED, &tls_ctx->flags));

}



/* Driver's seq tracking has to be disabled until resync succeeded */

static inline bool tls_offload_tx_resync_pending(struct sock *sk)

{
@@ -612,6 +615,9 @@ static inline bool tls_offload_tx_resync_pending(struct sock *sk) 
	return ret;

}



int __net_init tls_proc_init(struct net *net);

void __net_exit tls_proc_fini(struct net *net);



int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,

		      unsigned char *record_type);

int decrypt_skb(struct sock *sk, struct sk_buff *skb,
@@ -634,6 +640,7 @@ void tls_device_free_resources_tx(struct sock *sk); 
int tls_set_device_offload_rx(struct sock *sk, struct tls_context *ctx);

void tls_device_offload_cleanup_rx(struct sock *sk);

void tls_device_rx_resync_new_rec(struct sock *sk, u32 rcd_len, u32 seq);

void tls_offload_tx_resync_request(struct sock *sk, u32 got_seq, u32 exp_seq);

int tls_device_decrypted(struct sock *sk, struct sk_buff *skb);

#else

static inline void tls_device_init(void) {}

CRA Git | Maintained and supported by SUSTech CRA and CCSE