net/tls: add skeleton of MIB statistics

Add a skeleton structure for adding TLS statistics.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/tls.rst b/Documentation/networking/tls.rst
index 5bcbf75e2025ffb302f68d7e49ceeefdf30f6c0d..a6ee595630eda91f0be17156ce69bda08c737787 100644 (file)
--- a/Documentation/networking/tls.rst
+++ b/Documentation/networking/tls.rst
@@ -213,3 +213,9 @@ A patchset to OpenSSL to use ktls as the record layer is
 of calling send directly after a handshake using gnutls.
 Since it doesn't implement a full record layer, control
 messages are not supported.
+
+Statistics
+==========
+
+TLS implementation exposes the following per-namespace statistics
+(``/proc/net/tls_stat``):

diff --git a/include/net/netns/mib.h b/include/net/netns/mib.h
index 830bdf345b1726344137c7d95fc69d032be6f42b..b5fdb108d602349f9036e78c10433b6041ba26d9 100644 (file)
--- a/include/net/netns/mib.h
+++ b/include/net/netns/mib.h
@@ -24,6 +24,9 @@ struct netns_mib {
 #ifdef CONFIG_XFRM_STATISTICS
        DEFINE_SNMP_STAT(struct linux_xfrm_mib, xfrm_statistics);
 #endif
+#if IS_ENABLED(CONFIG_TLS)
+       DEFINE_SNMP_STAT(struct linux_tls_mib, tls_statistics);
+#endif
 };
 
 #endif

diff --git a/include/net/snmp.h b/include/net/snmp.h
index cb8ced4380a6a0acb703ddad23052cf5d49fc01b..468a67836e2f1fcf744b845784312175fab63668 100644 (file)
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -111,6 +111,12 @@ struct linux_xfrm_mib {
        unsigned long   mibs[LINUX_MIB_XFRMMAX];
 };
 
+/* Linux TLS */
+#define LINUX_MIB_TLSMAX       __LINUX_MIB_TLSMAX
+struct linux_tls_mib {
+       unsigned long   mibs[LINUX_MIB_TLSMAX];
+};
+
 #define DEFINE_SNMP_STAT(type, name)   \
        __typeof__(type) __percpu *name
 #define DEFINE_SNMP_STAT_ATOMIC(type, name)    \

diff --git a/include/net/tls.h b/include/net/tls.h
index 38086ade65ce66dacaa3d7caf8bbf85bd6f4d418..24c37bffc961f8e69ece08c4c421de28c7675591 100644 (file)
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -43,6 +43,7 @@
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
 
+#include <net/net_namespace.h>
 #include <net/tcp.h>
 #include <net/strparser.h>
 #include <crypto/aead.h>
@@ -73,6 +74,15 @@
  */
 #define TLS_AES_CCM_IV_B0_BYTE         2
 
+#define __TLS_INC_STATS(net, field)                            \
+       __SNMP_INC_STATS((net)->mib.tls_statistics, field)
+#define TLS_INC_STATS(net, field)                              \
+       SNMP_INC_STATS((net)->mib.tls_statistics, field)
+#define __TLS_DEC_STATS(net, field)                            \
+       __SNMP_DEC_STATS((net)->mib.tls_statistics, field)
+#define TLS_DEC_STATS(net, field)                              \
+       SNMP_DEC_STATS((net)->mib.tls_statistics, field)
+
 enum {
        TLS_BASE,
        TLS_SW,
@@ -605,6 +615,9 @@ static inline bool tls_offload_tx_resync_pending(struct sock *sk)
        return ret;
 }
 
+int __net_init tls_proc_init(struct net *net);
+void __net_exit tls_proc_fini(struct net *net);
+
 int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,
                      unsigned char *record_type);
 int decrypt_skb(struct sock *sk, struct sk_buff *skb,

diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index 549a31c29f7d4ebbc3a861244e9757c3ebbc2d0d..4abd57948ad453a446a3f0e7a81199a7cb00e9d7 100644 (file)
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -323,4 +323,11 @@ enum
        __LINUX_MIB_XFRMMAX
 };
 
+/* linux TLS mib definitions */
+enum
+{
+       LINUX_MIB_TLSNUM = 0,
+       __LINUX_MIB_TLSMAX
+};
+
 #endif /* _LINUX_SNMP_H */

diff --git a/net/tls/Makefile b/net/tls/Makefile
index 0606d43d758223be1ade478ed02fc0d2fb1130d1..f1ffbfe8968dd884c06a7c2e97e63fe6f7a78bfc 100644 (file)
--- a/net/tls/Makefile
+++ b/net/tls/Makefile
@@ -7,7 +7,7 @@ CFLAGS_trace.o := -I$(src)
 
 obj-$(CONFIG_TLS) += tls.o
 
-tls-y := tls_main.o tls_sw.o trace.o
+tls-y := tls_main.o tls_sw.o tls_proc.o trace.o
 
 tls-$(CONFIG_TLS_TOE) += tls_toe.o
 tls-$(CONFIG_TLS_DEVICE) += tls_device.o tls_device_fallback.o

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 237e58e4928aff18fe9fc6f498056351e5095a20..686eba0df5908d3fbcc19f7b8ed5e289a0499e94 100644 (file)
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -41,6 +41,7 @@
 #include <linux/inetdevice.h>
 #include <linux/inet_diag.h>
 
+#include <net/snmp.h>
 #include <net/tls.h>
 #include <net/tls_toe.h>
 
@@ -795,6 +796,35 @@ static size_t tls_get_info_size(const struct sock *sk)
        return size;
 }
 
+static int __net_init tls_init_net(struct net *net)
+{
+       int err;
+
+       net->mib.tls_statistics = alloc_percpu(struct linux_tls_mib);
+       if (!net->mib.tls_statistics)
+               return -ENOMEM;
+
+       err = tls_proc_init(net);
+       if (err)
+               goto err_free_stats;
+
+       return 0;
+err_free_stats:
+       free_percpu(net->mib.tls_statistics);
+       return err;
+}
+
+static void __net_exit tls_exit_net(struct net *net)
+{
+       tls_proc_fini(net);
+       free_percpu(net->mib.tls_statistics);
+}
+
+static struct pernet_operations tls_proc_ops = {
+       .init = tls_init_net,
+       .exit = tls_exit_net,
+};
+
 static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {
        .name                   = "tls",
        .owner                  = THIS_MODULE,
@@ -806,6 +836,12 @@ static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {
 
 static int __init tls_register(void)
 {
+       int err;
+
+       err = register_pernet_subsys(&tls_proc_ops);
+       if (err)
+               return err;
+
        tls_sw_proto_ops = inet_stream_ops;
        tls_sw_proto_ops.splice_read = tls_sw_splice_read;
 
@@ -819,6 +855,7 @@ static void __exit tls_unregister(void)
 {
        tcp_unregister_ulp(&tcp_tls_ulp_ops);
        tls_device_cleanup();
+       unregister_pernet_subsys(&tls_proc_ops);
 }
 
 module_init(tls_register);

diff --git a/net/tls/tls_proc.c b/net/tls/tls_proc.c
new file mode 100644 (file)
index 0000000..4ecc7c3
--- /dev/null
+++ b/net/tls/tls_proc.c
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2019 Netronome Systems, Inc. */
+
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <net/snmp.h>
+#include <net/tls.h>
+
+static const struct snmp_mib tls_mib_list[] = {
+       SNMP_MIB_SENTINEL
+};
+
+static int tls_statistics_seq_show(struct seq_file *seq, void *v)
+{
+       unsigned long buf[LINUX_MIB_TLSMAX] = {};
+       struct net *net = seq->private;
+       int i;
+
+       snmp_get_cpu_field_batch(buf, tls_mib_list, net->mib.tls_statistics);
+       for (i = 0; tls_mib_list[i].name; i++)
+               seq_printf(seq, "%-32s\t%lu\n", tls_mib_list[i].name, buf[i]);
+
+       return 0;
+}
+
+int __net_init tls_proc_init(struct net *net)
+{
+       if (!proc_create_net_single("tls_stat", 0444, net->proc_net,
+                                   tls_statistics_seq_show, NULL))
+               return -ENOMEM;
+       return 0;
+}
+
+void __net_exit tls_proc_fini(struct net *net)
+{
+       remove_proc_entry("tls_stat", net->proc_net);
+}