net/handshake: Trace events for TLS Alert helpers
Add observability for the new TLS Alert infrastructure. Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Link: https://lore.kernel.org/r/169047947409.5241.14548832149596892717.stgit@oracle-102.nfsv4bat.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
parent
39067dda1d
commit
b470985c76
|
@ -6,7 +6,86 @@
|
||||||
#define _TRACE_HANDSHAKE_H
|
#define _TRACE_HANDSHAKE_H
|
||||||
|
|
||||||
#include <linux/net.h>
|
#include <linux/net.h>
|
||||||
|
#include <net/tls_prot.h>
|
||||||
#include <linux/tracepoint.h>
|
#include <linux/tracepoint.h>
|
||||||
|
#include <trace/events/net_probe_common.h>
|
||||||
|
|
||||||
|
#define TLS_RECORD_TYPE_LIST \
|
||||||
|
record_type(CHANGE_CIPHER_SPEC) \
|
||||||
|
record_type(ALERT) \
|
||||||
|
record_type(HANDSHAKE) \
|
||||||
|
record_type(DATA) \
|
||||||
|
record_type(HEARTBEAT) \
|
||||||
|
record_type(TLS12_CID) \
|
||||||
|
record_type_end(ACK)
|
||||||
|
|
||||||
|
#undef record_type
|
||||||
|
#undef record_type_end
|
||||||
|
#define record_type(x) TRACE_DEFINE_ENUM(TLS_RECORD_TYPE_##x);
|
||||||
|
#define record_type_end(x) TRACE_DEFINE_ENUM(TLS_RECORD_TYPE_##x);
|
||||||
|
|
||||||
|
TLS_RECORD_TYPE_LIST
|
||||||
|
|
||||||
|
#undef record_type
|
||||||
|
#undef record_type_end
|
||||||
|
#define record_type(x) { TLS_RECORD_TYPE_##x, #x },
|
||||||
|
#define record_type_end(x) { TLS_RECORD_TYPE_##x, #x }
|
||||||
|
|
||||||
|
#define show_tls_content_type(type) \
|
||||||
|
__print_symbolic(type, TLS_RECORD_TYPE_LIST)
|
||||||
|
|
||||||
|
TRACE_DEFINE_ENUM(TLS_ALERT_LEVEL_WARNING);
|
||||||
|
TRACE_DEFINE_ENUM(TLS_ALERT_LEVEL_FATAL);
|
||||||
|
|
||||||
|
#define show_tls_alert_level(level) \
|
||||||
|
__print_symbolic(level, \
|
||||||
|
{ TLS_ALERT_LEVEL_WARNING, "Warning" }, \
|
||||||
|
{ TLS_ALERT_LEVEL_FATAL, "Fatal" })
|
||||||
|
|
||||||
|
#define TLS_ALERT_DESCRIPTION_LIST \
|
||||||
|
alert_description(CLOSE_NOTIFY) \
|
||||||
|
alert_description(UNEXPECTED_MESSAGE) \
|
||||||
|
alert_description(BAD_RECORD_MAC) \
|
||||||
|
alert_description(RECORD_OVERFLOW) \
|
||||||
|
alert_description(HANDSHAKE_FAILURE) \
|
||||||
|
alert_description(BAD_CERTIFICATE) \
|
||||||
|
alert_description(UNSUPPORTED_CERTIFICATE) \
|
||||||
|
alert_description(CERTIFICATE_REVOKED) \
|
||||||
|
alert_description(CERTIFICATE_EXPIRED) \
|
||||||
|
alert_description(CERTIFICATE_UNKNOWN) \
|
||||||
|
alert_description(ILLEGAL_PARAMETER) \
|
||||||
|
alert_description(UNKNOWN_CA) \
|
||||||
|
alert_description(ACCESS_DENIED) \
|
||||||
|
alert_description(DECODE_ERROR) \
|
||||||
|
alert_description(DECRYPT_ERROR) \
|
||||||
|
alert_description(TOO_MANY_CIDS_REQUESTED) \
|
||||||
|
alert_description(PROTOCOL_VERSION) \
|
||||||
|
alert_description(INSUFFICIENT_SECURITY) \
|
||||||
|
alert_description(INTERNAL_ERROR) \
|
||||||
|
alert_description(INAPPROPRIATE_FALLBACK) \
|
||||||
|
alert_description(USER_CANCELED) \
|
||||||
|
alert_description(MISSING_EXTENSION) \
|
||||||
|
alert_description(UNSUPPORTED_EXTENSION) \
|
||||||
|
alert_description(UNRECOGNIZED_NAME) \
|
||||||
|
alert_description(BAD_CERTIFICATE_STATUS_RESPONSE) \
|
||||||
|
alert_description(UNKNOWN_PSK_IDENTITY) \
|
||||||
|
alert_description(CERTIFICATE_REQUIRED) \
|
||||||
|
alert_description_end(NO_APPLICATION_PROTOCOL)
|
||||||
|
|
||||||
|
#undef alert_description
|
||||||
|
#undef alert_description_end
|
||||||
|
#define alert_description(x) TRACE_DEFINE_ENUM(TLS_ALERT_DESC_##x);
|
||||||
|
#define alert_description_end(x) TRACE_DEFINE_ENUM(TLS_ALERT_DESC_##x);
|
||||||
|
|
||||||
|
TLS_ALERT_DESCRIPTION_LIST
|
||||||
|
|
||||||
|
#undef alert_description
|
||||||
|
#undef alert_description_end
|
||||||
|
#define alert_description(x) { TLS_ALERT_DESC_##x, #x },
|
||||||
|
#define alert_description_end(x) { TLS_ALERT_DESC_##x, #x }
|
||||||
|
|
||||||
|
#define show_tls_alert_description(desc) \
|
||||||
|
__print_symbolic(desc, TLS_ALERT_DESCRIPTION_LIST)
|
||||||
|
|
||||||
DECLARE_EVENT_CLASS(handshake_event_class,
|
DECLARE_EVENT_CLASS(handshake_event_class,
|
||||||
TP_PROTO(
|
TP_PROTO(
|
||||||
|
@ -106,6 +185,47 @@ DECLARE_EVENT_CLASS(handshake_error_class,
|
||||||
), \
|
), \
|
||||||
TP_ARGS(net, req, sk, err))
|
TP_ARGS(net, req, sk, err))
|
||||||
|
|
||||||
|
DECLARE_EVENT_CLASS(handshake_alert_class,
|
||||||
|
TP_PROTO(
|
||||||
|
const struct sock *sk,
|
||||||
|
unsigned char level,
|
||||||
|
unsigned char description
|
||||||
|
),
|
||||||
|
TP_ARGS(sk, level, description),
|
||||||
|
TP_STRUCT__entry(
|
||||||
|
/* sockaddr_in6 is always bigger than sockaddr_in */
|
||||||
|
__array(__u8, saddr, sizeof(struct sockaddr_in6))
|
||||||
|
__array(__u8, daddr, sizeof(struct sockaddr_in6))
|
||||||
|
__field(unsigned int, netns_ino)
|
||||||
|
__field(unsigned long, level)
|
||||||
|
__field(unsigned long, description)
|
||||||
|
),
|
||||||
|
TP_fast_assign(
|
||||||
|
const struct inet_sock *inet = inet_sk(sk);
|
||||||
|
|
||||||
|
memset(__entry->saddr, 0, sizeof(struct sockaddr_in6));
|
||||||
|
memset(__entry->daddr, 0, sizeof(struct sockaddr_in6));
|
||||||
|
TP_STORE_ADDR_PORTS(__entry, inet, sk);
|
||||||
|
|
||||||
|
__entry->netns_ino = sock_net(sk)->ns.inum;
|
||||||
|
__entry->level = level;
|
||||||
|
__entry->description = description;
|
||||||
|
),
|
||||||
|
TP_printk("src=%pISpc dest=%pISpc %s: %s",
|
||||||
|
__entry->saddr, __entry->daddr,
|
||||||
|
show_tls_alert_level(__entry->level),
|
||||||
|
show_tls_alert_description(__entry->description)
|
||||||
|
)
|
||||||
|
);
|
||||||
|
#define DEFINE_HANDSHAKE_ALERT(name) \
|
||||||
|
DEFINE_EVENT(handshake_alert_class, name, \
|
||||||
|
TP_PROTO( \
|
||||||
|
const struct sock *sk, \
|
||||||
|
unsigned char level, \
|
||||||
|
unsigned char description \
|
||||||
|
), \
|
||||||
|
TP_ARGS(sk, level, description))
|
||||||
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Request lifetime events
|
* Request lifetime events
|
||||||
|
@ -154,6 +274,46 @@ DEFINE_HANDSHAKE_ERROR(handshake_cmd_accept_err);
|
||||||
DEFINE_HANDSHAKE_FD_EVENT(handshake_cmd_done);
|
DEFINE_HANDSHAKE_FD_EVENT(handshake_cmd_done);
|
||||||
DEFINE_HANDSHAKE_ERROR(handshake_cmd_done_err);
|
DEFINE_HANDSHAKE_ERROR(handshake_cmd_done_err);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* TLS Record events
|
||||||
|
*/
|
||||||
|
|
||||||
|
TRACE_EVENT(tls_contenttype,
|
||||||
|
TP_PROTO(
|
||||||
|
const struct sock *sk,
|
||||||
|
unsigned char type
|
||||||
|
),
|
||||||
|
TP_ARGS(sk, type),
|
||||||
|
TP_STRUCT__entry(
|
||||||
|
/* sockaddr_in6 is always bigger than sockaddr_in */
|
||||||
|
__array(__u8, saddr, sizeof(struct sockaddr_in6))
|
||||||
|
__array(__u8, daddr, sizeof(struct sockaddr_in6))
|
||||||
|
__field(unsigned int, netns_ino)
|
||||||
|
__field(unsigned long, type)
|
||||||
|
),
|
||||||
|
TP_fast_assign(
|
||||||
|
const struct inet_sock *inet = inet_sk(sk);
|
||||||
|
|
||||||
|
memset(__entry->saddr, 0, sizeof(struct sockaddr_in6));
|
||||||
|
memset(__entry->daddr, 0, sizeof(struct sockaddr_in6));
|
||||||
|
TP_STORE_ADDR_PORTS(__entry, inet, sk);
|
||||||
|
|
||||||
|
__entry->netns_ino = sock_net(sk)->ns.inum;
|
||||||
|
__entry->type = type;
|
||||||
|
),
|
||||||
|
TP_printk("src=%pISpc dest=%pISpc %s",
|
||||||
|
__entry->saddr, __entry->daddr,
|
||||||
|
show_tls_content_type(__entry->type)
|
||||||
|
)
|
||||||
|
);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* TLS Alert events
|
||||||
|
*/
|
||||||
|
|
||||||
|
DEFINE_HANDSHAKE_ALERT(tls_alert_send);
|
||||||
|
DEFINE_HANDSHAKE_ALERT(tls_alert_recv);
|
||||||
|
|
||||||
#endif /* _TRACE_HANDSHAKE_H */
|
#endif /* _TRACE_HANDSHAKE_H */
|
||||||
|
|
||||||
#include <trace/define_trace.h>
|
#include <trace/define_trace.h>
|
||||||
|
|
|
@ -21,6 +21,8 @@
|
||||||
|
|
||||||
#include "handshake.h"
|
#include "handshake.h"
|
||||||
|
|
||||||
|
#include <trace/events/handshake.h>
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* tls_alert_send - send a TLS Alert on a kTLS socket
|
* tls_alert_send - send a TLS Alert on a kTLS socket
|
||||||
* @sock: open kTLS socket to send on
|
* @sock: open kTLS socket to send on
|
||||||
|
@ -39,6 +41,8 @@ int tls_alert_send(struct socket *sock, u8 level, u8 description)
|
||||||
u8 alert[2];
|
u8 alert[2];
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
|
trace_tls_alert_send(sock->sk, level, description);
|
||||||
|
|
||||||
alert[0] = level;
|
alert[0] = level;
|
||||||
alert[1] = description;
|
alert[1] = description;
|
||||||
iov.iov_base = alert;
|
iov.iov_base = alert;
|
||||||
|
@ -77,6 +81,7 @@ u8 tls_get_record_type(const struct sock *sk, const struct cmsghdr *cmsg)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
record_type = *((u8 *)CMSG_DATA(cmsg));
|
record_type = *((u8 *)CMSG_DATA(cmsg));
|
||||||
|
trace_tls_contenttype(sk, record_type);
|
||||||
return record_type;
|
return record_type;
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(tls_get_record_type);
|
EXPORT_SYMBOL(tls_get_record_type);
|
||||||
|
@ -99,5 +104,7 @@ void tls_alert_recv(const struct sock *sk, const struct msghdr *msg,
|
||||||
data = iov->iov_base;
|
data = iov->iov_base;
|
||||||
*level = data[0];
|
*level = data[0];
|
||||||
*description = data[1];
|
*description = data[1];
|
||||||
|
|
||||||
|
trace_tls_alert_recv(sk, *level, *description);
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(tls_alert_recv);
|
EXPORT_SYMBOL(tls_alert_recv);
|
||||||
|
|
|
@ -8,8 +8,10 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include <linux/types.h>
|
#include <linux/types.h>
|
||||||
|
#include <linux/ipv6.h>
|
||||||
|
|
||||||
#include <net/sock.h>
|
#include <net/sock.h>
|
||||||
|
#include <net/inet_sock.h>
|
||||||
#include <net/netlink.h>
|
#include <net/netlink.h>
|
||||||
#include <net/genetlink.h>
|
#include <net/genetlink.h>
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue