Introduce getsockopt(TCP_AO_GET_KEYS) that lets a user get TCP-AO keys and their properties from a socket. The user can provide a filter to match the specific key to be dumped or ::get_all = 1 may be used to dump all keys in one syscall. Add another getsockopt(TCP_AO_INFO) for providing per-socket/per-ao_info stats: packet counters, Current_key/RNext_key and flags like ::ao_required and ::accept_icmps.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -131,7 +131,8 @@ enum { · 130 unmodified lines | |||
| 131 | 131 | ||
| 132 | #define TCP_AO_ADD_KEY 38 /* Add/Set MKT */ | 132 | #define TCP_AO_ADD_KEY 38 /* Add/Set MKT */ |
| 133 | #define TCP_AO_DEL_KEY 39 /* Delete MKT */ | 133 | #define TCP_AO_DEL_KEY 39 /* Delete MKT */ |
| 134 | #define TCP_AO_INFO 40 /* Modify TCP-AO per-socket options */ | 134 | #define TCP_AO_INFO 40 /* Set/list TCP-AO per-socket options */ |
| 135 | #define TCP_AO_GET_KEYS 41 /* List MKT(s) */ | ||
| 135 | 136 | ||
| 136 | #define TCP_REPAIR_ON 1 | 137 | #define TCP_REPAIR_ON 1 |
| 137 | #define TCP_REPAIR_OFF 0 | 138 | #define TCP_REPAIR_OFF 0 |
| @@ -405,21 +406,55 @@ struct tcp_ao_del { /* setsockopt(TCP_AO_DEL_KEY) */ · 267 unmodified lines | |||
| 405 | __u8 keyflags; /* see TCP_AO_KEYF_ */ | 406 | __u8 keyflags; /* see TCP_AO_KEYF_ */ |
| 406 | } __attribute__((aligned(8))); | 407 | } __attribute__((aligned(8))); |
| 407 | 408 | ||
| 408 | struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO) */ | 409 | struct tcp_ao_info_opt { /* setsockopt(TCP_AO_INFO), getsockopt(TCP_AO_INFO) */ |
| 409 | __u32 set_current :1, /* corresponding ::current_key */ | 410 | /* Here 'in' is for setsockopt(), 'out' is for getsockopt() */ |
| 410 | set_rnext :1, /* corresponding ::rnext */ | 411 | __u32 set_current :1, /* in/out: corresponding ::current_key */ |
| 411 | ao_required :1, /* don't accept non-AO connects */ | 412 | set_rnext :1, /* in/out: corresponding ::rnext */ |
| 412 | set_counters :1, /* set/clear ::pkt_* counters */ | 413 | ao_required :1, /* in/out: don't accept non-AO connects */ |
| 413 | accept_icmps :1, /* accept incoming ICMPs */ | 414 | set_counters :1, /* in: set/clear ::pkt_* counters */ |
| 415 | accept_icmps :1, /* in/out: accept incoming ICMPs */ | ||
| 414 | reserved :27; /* must be 0 */ | 416 | reserved :27; /* must be 0 */ |
| 415 | __u16 reserved2; /* padding, must be 0 */ | 417 | __u16 reserved2; /* padding, must be 0 */ |
| 416 | __u8 current_key; /* KeyID to set as Current_key */ | 418 | __u8 current_key; /* in/out: KeyID of Current_key */ |
| 417 | __u8 rnext; /* KeyID to set as Rnext_key */ | 419 | __u8 rnext; /* in/out: keyid of RNext_key */ |
| 418 | __u64 pkt_good; /* verified segments */ | 420 | __u64 pkt_good; /* in/out: verified segments */ |
| 419 | __u64 pkt_bad; /* failed verification */ | 421 | __u64 pkt_bad; /* in/out: failed verification */ |
| 420 | __u64 pkt_key_not_found; /* could not find a key to verify */ | 422 | __u64 pkt_key_not_found; /* in/out: could not find a key to verify */ |
| 421 | __u64 pkt_ao_required; /* segments missing TCP-AO sign */ | 423 | __u64 pkt_ao_required; /* in/out: segments missing TCP-AO sign */ |
| 422 | __u64 pkt_dropped_icmp; /* ICMPs that were ignored */ | 424 | __u64 pkt_dropped_icmp; /* in/out: ICMPs that were ignored */ |
| 425 | } __attribute__((aligned(8))); | ||
| 426 | |||
| 427 | struct tcp_ao_getsockopt { /* getsockopt(TCP_AO_GET_KEYS) */ | ||
| 428 | struct __kernel_sockaddr_storage addr; /* in/out: dump keys for peer | ||
| 429 | * with this address/prefix | ||
| 430 | */ | ||
| 431 | char alg_name[64]; /* out: crypto hash algorithm */ | ||
| 432 | __u8 key[TCP_AO_MAXKEYLEN]; | ||
| 433 | __u32 nkeys; /* in: size of the userspace buffer | ||
| 434 | * @optval, measured in @optlen - the | ||
| 435 | * sizeof(struct tcp_ao_getsockopt) | ||
| 436 | * out: number of keys that matched | ||
| 437 | */ | ||
| 438 | __u16 is_current :1, /* in: match and dump Current_key, | ||
| 439 | * out: the dumped key is Current_key | ||
| 440 | */ | ||
| 441 | |||
| 442 | is_rnext :1, /* in: match and dump RNext_key, | ||
| 443 | * out: the dumped key is RNext_key | ||
| 444 | */ | ||
| 445 | get_all :1, /* in: dump all keys */ | ||
| 446 | reserved :13; /* padding, must be 0 */ | ||
| 447 | __u8 sndid; /* in/out: dump keys with SendID */ | ||
| 448 | __u8 rcvid; /* in/out: dump keys with RecvID */ | ||
| 449 | __u8 prefix; /* in/out: dump keys with address/prefix */ | ||
| 450 | __u8 maclen; /* out: key's length of authentication | ||
| 451 | * code (hash) | ||
| 452 | */ | ||
| 453 | __u8 keyflags; /* in/out: see TCP_AO_KEYF_ */ | ||
| 454 | __u8 keylen; /* out: length of ::key */ | ||
| 455 | __s32 ifindex; /* in/out: L3 dev index for VRF */ | ||
| 456 | __u64 pkt_good; /* out: verified segments */ | ||
| 457 | __u64 pkt_bad; /* out: segments that failed verification */ | ||
| 423 | } __attribute__((aligned(8))); | 458 | } __attribute__((aligned(8))); |
| 424 | 459 | ||
| 425 | /* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */ | 460 | /* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */ |