Piecuu/linux-samsung-r9q2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

net/tcp: Add TCP-AO getsockopt()s

Browse source 
Introduce getsockopt(TCP_AO_GET_KEYS) that lets a user get TCP-AO keys
and their properties from a socket. The user can provide a filter
to match the specific key to be dumped or ::get_all = 1 may be
used to dump all keys in one syscall.

Add another getsockopt(TCP_AO_INFO) for providing per-socket/per-ao_info
stats: packet counters, Current_key/RNext_key and flags like
::ao_required and ::accept_icmps.

Co-developed-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Co-developed-by: Salam Noureddine <noureddine@arista.com>
Signed-off-by: Salam Noureddine <noureddine@arista.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dmitry Safonov 2023-10-23 20:22:10 +01:00 • committed by David S. Miller
parent 7753c2f0a8
commit ef84703a91
4 changed files with 369 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

63
include/uapi/linux/tcp.h
View file

@ -131,7 +131,8 @@ enum {
#define TCP_AO_ADD_KEY 38 /* Add/Set MKT */
#define TCP_AO_DEL_KEY 39 /* Delete MKT */
#define TCP_AO_INFO 40 /* Modify TCP-AO per-socket options */
#define TCP_AO_INFO 40 /* Set/list TCP-AO per-socket options */
#define TCP_AO_GET_KEYS 41 /* List MKT(s) */
#define TCP_REPAIR_ON 1
#define TCP_REPAIR_OFF 0
@ -405,21 +406,55 @@ struct tcp_ao_del { /* setsockopt(TCP_AO_DEL_KEY) */
__u8 keyflags; /* see TCP_AO_KEYF_ */
} __attribute__((aligned(8)));
struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO) */
__u32 set_current :1, /* corresponding ::current_key */
set_rnext :1, /* corresponding ::rnext */
ao_required :1, /* don't accept non-AO connects */
set_counters :1, /* set/clear ::pkt_* counters */
accept_icmps :1, /* accept incoming ICMPs */
struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO), getsockopt(TCP_AO_INFO) */
/* Here 'in' is for setsockopt(), 'out' is for getsockopt() */
__u32 set_current :1, /* in/out: corresponding ::current_key */
set_rnext :1, /* in/out: corresponding ::rnext */
ao_required :1, /* in/out: don't accept non-AO connects */
set_counters :1, /* in: set/clear ::pkt_* counters */
accept_icmps :1, /* in/out: accept incoming ICMPs */
reserved :27; /* must be 0 */
__u16 reserved2; /* padding, must be 0 */
__u8 current_key; /* KeyID to set as Current_key */
__u8 rnext; /* KeyID to set as Rnext_key */
__u64 pkt_good; /* verified segments */
__u64 pkt_bad; /* failed verification */
__u64 pkt_key_not_found; /* could not find a key to verify */
__u64 pkt_ao_required; /* segments missing TCP-AO sign */
__u64 pkt_dropped_icmp; /* ICMPs that were ignored */
__u8 current_key; /* in/out: KeyID of Current_key */
__u8 rnext; /* in/out: keyid of RNext_key */
__u64 pkt_good; /* in/out: verified segments */
__u64 pkt_bad; /* in/out: failed verification */
__u64 pkt_key_not_found; /* in/out: could not find a key to verify */
__u64 pkt_ao_required; /* in/out: segments missing TCP-AO sign */
__u64 pkt_dropped_icmp; /* in/out: ICMPs that were ignored */
} __attribute__((aligned(8)));
struct tcp_ao_getsockopt { /* getsockopt(TCP_AO_GET_KEYS) */
struct __kernel_sockaddr_storage addr; /* in/out: dump keys for peer
* with this address/prefix
*/
char alg_name[64]; /* out: crypto hash algorithm */
__u8 key[TCP_AO_MAXKEYLEN];
__u32 nkeys; /* in: size of the userspace buffer
* @optval, measured in @optlen - the
* sizeof(struct tcp_ao_getsockopt)
* out: number of keys that matched
*/
__u16 is_current :1, /* in: match and dump Current_key,
* out: the dumped key is Current_key
*/
is_rnext :1, /* in: match and dump RNext_key,
* out: the dumped key is RNext_key
*/
get_all :1, /* in: dump all keys */
reserved :13; /* padding, must be 0 */
__u8 sndid; /* in/out: dump keys with SendID */
__u8 rcvid; /* in/out: dump keys with RecvID */
__u8 prefix; /* in/out: dump keys with address/prefix */
__u8 maclen; /* out: key's length of authentication
* code (hash)
*/
__u8 keyflags; /* in/out: see TCP_AO_KEYF_ */
__u8 keylen; /* out: length of ::key */
__s32 ifindex; /* in/out: L3 dev index for VRF */
__u64 pkt_good; /* out: verified segments */
__u64 pkt_bad; /* out: segments that failed verification */
} __attribute__((aligned(8)));
/* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */