From nobody Mon Jun 9 23:48:04 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bGTBX5jwNz5yh8M; Mon, 09 Jun 2025 23:48:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bGTBX1ZlMz3Drs; Mon, 09 Jun 2025 23:48:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1749512884; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hUQ/oGVqS8cmVD13HG96IGm9Qi6qSRPL9vgd5yu2OsI=; b=MCE7XBkgVeDsttB7S1pE0ceFdvM9k4WkcYSoL0ymKKPBKLO+CFtG880Pfy+Q7ocTKAumjh +wbA9KHXtulcGKFQmiPdTqFhgM+TuuL3UD9+6dToj7p1qNeT9UMCzqDrB0WHfRFsAP3a6l EH9Ft2qBLvX9cJmS3bprQCpf9UUHj5z2PCvceZdBBz5H7YMSfmVvAev7XX/ZOndB3TsX3O NdlFbgq41a5Tyi04jdiGvUWm77pls9KPj1UJlBSmN4XlzZazMLdPvi3pCPhkvlg8rAWtLF 3d6Np/7VaIfugdOtJHkFKwoE4QtOoc5kZ4zm7gb+kuWWonvq9KnknKvSaYJRJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1749512884; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hUQ/oGVqS8cmVD13HG96IGm9Qi6qSRPL9vgd5yu2OsI=; b=Aa1dTccPyrLsNuHmcxAlGTBQdXzogQ8gmsdAMrRumH4m2iEQ+W7eyttRQXEFSvBQiDCoqf yBhBp8fXDfppaGrvuodpyFznhXEVjh9zumc1nj/sGuKTFUp1NsKpap9FsREnkVo6o+drL/ ioptSgbGWdweM17qCLLbhMozG688u1H6VF5EM+f1seSMJ0KSqqPMW0ivsSQoG/em6Wj0ni 2NKFUm29j8aCby9rkAKau6+zjiRksfxn8FsFz+/lXNYR5a1GKNvhWm30LM5Z9o+tz5KwEE mspaYeToncDd5R9H3MCfRCvKLcKGgHnspssFVf9PltFkQSkZAoQvwOfIphGGpw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1749512884; a=rsa-sha256; cv=none; b=wFR00P++7iYTT+woU+D/OgpIIIOyTzLdCpMErTSaymQTCPUjJY29c0+CxTsKdg74PqIDE0 NSN8+FcPQ5sNnbkVBYx6MlPHEnNgTl82ahVadgZ2u5b4WH66iqVmXIUiprWCod/oV8KGC7 GbAir4IEbmhtsPvs0BeAQg/XLlJqhAJ9jjdkCU4PVAUMxeKD4274FT9x23Vz1qWLm+o/Zl WXV8Q95PP6yXUJkoDmgwbqORP+4jkgkS5H2jCTb6p4eYHfMdYzjj8x54xYLiO84ybSKkxY lMxnQczmoXdmadpZtIeArrj1gJNMODbUsvtin0c83ud4WqQp7JZZuemqVSodFA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bGTBX0xQlz1tQ; Mon, 09 Jun 2025 23:48:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 559Nm4pF088830; Mon, 9 Jun 2025 23:48:04 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 559Nm4O4088827; Mon, 9 Jun 2025 23:48:04 GMT (envelope-from git) Date: Mon, 9 Jun 2025 23:48:04 GMT Message-Id: <202506092348.559Nm4O4088827@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: 5fea0d9e9dbf - main - sysctl net.inet.tcp.ktlslist List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5fea0d9e9dbfe741ab614d05d916ab91472144bf Auto-Submitted: auto-generated The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=5fea0d9e9dbfe741ab614d05d916ab91472144bf commit 5fea0d9e9dbfe741ab614d05d916ab91472144bf Author: Konstantin Belousov AuthorDate: 2025-05-20 08:07:49 +0000 Commit: Konstantin Belousov CommitDate: 2025-06-09 23:47:13 +0000 sysctl net.inet.tcp.ktlslist Reviewed by: jhb (previous version), markj Sponsored by: NVidia networking Differential revision: https://reviews.freebsd.org/D50653 --- sys/netinet/tcp_subr.c | 212 +++++++++++++++++++++++++++++++++++++++++++++++++ sys/netinet/tcp_var.h | 3 + 2 files changed, 215 insertions(+) diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index f3f28f54c459..f766bf25ad66 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2664,6 +2664,218 @@ SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist, NULL, 0, tcp_pcblist, "S,xtcpcb", "List of active TCP connections"); +#define SND_TAG_STATUS_MAXLEN 128 + +#ifdef KERN_TLS +static int +tcp_ktlslist(SYSCTL_HANDLER_ARGS, bool export_keys) +{ + struct xinpgen xig; + struct inpcb *inp; + struct socket *so; + struct ktls_session *ksr, *kss; + char *buf; + struct xktls_session *xktls; + uint64_t ipi_gencnt; + size_t buflen, len, sz; + u_int cnt; + int error; + bool ek, p; + + if (req->newptr != NULL) + return (EPERM); + + len = 0; + cnt = 0; + ipi_gencnt = V_tcbinfo.ipi_gencnt; + bzero(&xig, sizeof(xig)); + xig.xig_len = sizeof(xig); + xig.xig_gen = atomic_load_acq_64(&ktls_glob_gen); + xig.xig_sogen = so_gencnt; + + struct inpcb_iterator inpi = INP_ALL_ITERATOR(&V_tcbinfo, + INPLOOKUP_RLOCKPCB); + while ((inp = inp_next(&inpi)) != NULL) { + if (inp->inp_gencnt > ipi_gencnt || + cr_canseeinpcb(req->td->td_ucred, inp) != 0) + continue; + + so = inp->inp_socket; + if (so != NULL && so->so_gencnt <= xig.xig_sogen) { + p = false; + ek = export_keys && cr_canexport_ktlskeys( + req->td, inp); + ksr = so->so_rcv.sb_tls_info; + if (ktls_session_genvis(ksr, xig.xig_gen)) { + p = true; + if (ek) { + sz = SIZE_T_MAX; + ktls_session_copy_keys(ksr, + NULL, &sz); + len += sz; + } + if (ksr->snd_tag != NULL && + ksr->snd_tag->sw->snd_tag_status_str != + NULL) { + sz = SND_TAG_STATUS_MAXLEN; + ksr->snd_tag->sw->snd_tag_status_str( + ksr->snd_tag, NULL, &sz); + len += sz; + } + } + kss = so->so_snd.sb_tls_info; + if (ktls_session_genvis(kss, xig.xig_gen)) { + p = true; + if (ek) { + sz = SIZE_T_MAX; + ktls_session_copy_keys(kss, + NULL, &sz); + len += sz; + } + if (kss->snd_tag != NULL && + kss->snd_tag->sw->snd_tag_status_str != + NULL) { + sz = SND_TAG_STATUS_MAXLEN; + kss->snd_tag->sw->snd_tag_status_str( + kss->snd_tag, NULL, &sz); + len += sz; + } + } + if (p) { + len += sizeof(*xktls); + len = roundup2(len, __alignof(struct + xktls_session)); + } + } + } + if (req->oldptr == NULL) { + len += 2 * sizeof(xig); + len += 3 * len / 4; + req->oldidx = len; + return (0); + } + + if ((error = sysctl_wire_old_buffer(req, 0)) != 0) + return (error); + + error = SYSCTL_OUT(req, &xig, sizeof xig); + if (error != 0) + return (error); + + buflen = roundup2(sizeof(*xktls) + 2 * TLS_MAX_PARAM_SIZE + + 2 * SND_TAG_STATUS_MAXLEN, __alignof(struct xktls_session)); + buf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO); + struct inpcb_iterator inpi1 = INP_ALL_ITERATOR(&V_tcbinfo, + INPLOOKUP_RLOCKPCB); + while ((inp = inp_next(&inpi1)) != NULL) { + if (inp->inp_gencnt > ipi_gencnt || + cr_canseeinpcb(req->td->td_ucred, inp) != 0) + continue; + + so = inp->inp_socket; + if (so == NULL) + continue; + + p = false; + ek = export_keys && cr_canexport_ktlskeys(req->td, inp); + ksr = so->so_rcv.sb_tls_info; + kss = so->so_snd.sb_tls_info; + xktls = (struct xktls_session *)buf; + if (ktls_session_genvis(ksr, xig.xig_gen)) { + p = true; + ktls_session_to_xktls_onedir(ksr, ek, &xktls->rcv); + } + if (ktls_session_genvis(kss, xig.xig_gen)) { + p = true; + ktls_session_to_xktls_onedir(kss, ek, &xktls->snd); + } + if (!p) + continue; + + xktls->inp_gencnt = inp->inp_gencnt; + xktls->so_pcb = (kvaddr_t)inp; + memcpy(&xktls->coninf, &inp->inp_inc, sizeof(xktls->coninf)); + len = sizeof(*xktls); + if (ktls_session_genvis(ksr, xig.xig_gen)) { + if (ek) { + sz = buflen - len; + ktls_session_copy_keys(ksr, buf + len, &sz); + len += sz; + } else { + xktls->rcv.cipher_key_len = 0; + xktls->rcv.auth_key_len = 0; + } + if (ksr->snd_tag != NULL && + ksr->snd_tag->sw->snd_tag_status_str != NULL) { + sz = SND_TAG_STATUS_MAXLEN; + ksr->snd_tag->sw->snd_tag_status_str( + ksr->snd_tag, buf + len, &sz); + len += sz; + } + } + if (ktls_session_genvis(kss, xig.xig_gen)) { + if (ek) { + sz = buflen - len; + ktls_session_copy_keys(kss, buf + len, &sz); + len += sz; + } else { + xktls->snd.cipher_key_len = 0; + xktls->snd.auth_key_len = 0; + } + if (kss->snd_tag != NULL && + kss->snd_tag->sw->snd_tag_status_str != NULL) { + sz = SND_TAG_STATUS_MAXLEN; + kss->snd_tag->sw->snd_tag_status_str( + kss->snd_tag, buf + len, &sz); + len += sz; + } + } + len = roundup2(len, __alignof(*xktls)); + xktls->tsz = len; + xktls->fsz = sizeof(*xktls); + + error = SYSCTL_OUT(req, xktls, len); + if (error != 0) { + INP_RUNLOCK(inp); + break; + } + cnt++; + } + + if (error == 0) { + atomic_thread_fence_rel(); + xig.xig_gen = atomic_load_64(&ktls_glob_gen); + xig.xig_sogen = so_gencnt; + xig.xig_count = cnt; + error = SYSCTL_OUT(req, &xig, sizeof(xig)); + } + + zfree(buf, M_TEMP); + return (error); +} + +static int +tcp_ktlslist_nokeys(SYSCTL_HANDLER_ARGS) +{ + return (tcp_ktlslist(oidp, arg1, arg2, req, false)); +} + +static int +tcp_ktlslist_wkeys(SYSCTL_HANDLER_ARGS) +{ + return (tcp_ktlslist(oidp, arg1, arg2, req, true)); +} + +SYSCTL_PROC(_net_inet_tcp, TCPCTL_KTLSLIST, ktlslist, + CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, + NULL, 0, tcp_ktlslist_nokeys, "S,xktls_session", + "List of active kTLS sessions for TCP connections"); +SYSCTL_PROC(_net_inet_tcp, TCPCTL_KTLSLIST_WKEYS, ktlslist_wkeys, + CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, + NULL, 0, tcp_ktlslist_wkeys, "S,xktls_session", + "List of active kTLS sessions for TCP connections with keys"); +#endif /* KERN_TLS */ + #ifdef INET static int tcp_getcred(SYSCTL_HANDLER_ARGS) diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h index ddc701581f90..4d49f5d2a954 100644 --- a/sys/netinet/tcp_var.h +++ b/sys/netinet/tcp_var.h @@ -1234,6 +1234,9 @@ struct tcp_function_info { #define TCPCTL_SACK 14 /* Selective Acknowledgement,rfc 2018 */ #define TCPCTL_DROP 15 /* drop tcp connection */ #define TCPCTL_STATES 16 /* connection counts by TCP state */ +#define TCPCTL_KTLSLIST 17 /* connections with active ktls + session */ +#define TCPCTL_KTLSLIST_WKEYS 18 /* KTLSLIST with key data exported */ #ifdef _KERNEL #ifdef SYSCTL_DECL