str<<base<<"tcpavgconnectionduration" << ' '<< front->tcpAvgConnectionDuration.load() << " " << now << "\r\n";
str<<base<<"tlsnewsessions" << ' ' << front->tlsNewSessions.load() << " " << now << "\r\n";
str<<base<<"tlsresumptions" << ' ' << front->tlsResumptions.load() << " " << now << "\r\n";
+ str<<base<<"tls10-queries" << ' ' << front->tls10queries.load() << " " << now << "\r\n";
+ str<<base<<"tls11-queries" << ' ' << front->tls11queries.load() << " " << now << "\r\n";
+ str<<base<<"tls12-queries" << ' ' << front->tls12queries.load() << " " << now << "\r\n";
+ str<<base<<"tls13-queries" << ' ' << front->tls13queries.load() << " " << now << "\r\n";
+ str<<base<<"tls-unknown-queries" << ' ' << front->tlsUnknownqueries.load() << " " << now << "\r\n";
}
auto localPools = g_pools.getLocal();
{"http2-502-responses", doh->d_http2Stats.d_nb502Responses},
{"http1-other-responses", doh->d_http1Stats.d_nbOtherResponses},
{"http2-other-responses", doh->d_http2Stats.d_nbOtherResponses},
- {"tls10-queries", doh->d_tls10queries},
- {"tls11-queries", doh->d_tls11queries},
- {"tls12-queries", doh->d_tls12queries},
- {"tls13-queries", doh->d_tls13queries},
- {"tls-unknown-queries", doh->d_tlsUnknownqueries},
{"get-queries", doh->d_getqueries},
{"post-queries", doh->d_postqueries},
{"bad-requests", doh->d_badrequests},
ret << endl;
ret << "Frontends:" << endl;
- fmt = boost::format("%-3d %-20.20s %-20d %-20d %-25d %-20d %-20d %-20d %-20f %-20f %-15d %-15d");
- ret << (fmt % "#" % "Address" % "Connections" % "Died reading query" % "Died sending response" % "Gave up" % "Client timeouts" % "Downstream timeouts" % "Avg queries/conn" % "Avg duration" % "TLS new sessions" % "TLS Resumptions") << endl;
+ fmt = boost::format("%-3d %-20.20s %-20d %-20d %-25d %-20d %-20d %-20d %-20f %-20f %-15d %-15d %-15d %-15d %-15d %-15d %-15d");
+ ret << (fmt % "#" % "Address" % "Connections" % "Died reading query" % "Died sending response" % "Gave up" % "Client timeouts" % "Downstream timeouts" % "Avg queries/conn" % "Avg duration" % "TLS new sessions" % "TLS Resumptions" % "TLS 1.0" % "TLS 1.1" % "TLS 1.2" % "TLS 1.3" % "TLS other") << endl;
size_t counter = 0;
for(const auto& f : g_frontends) {
- ret << (fmt % counter % f->local.toStringWithPort() % f->tcpCurrentConnections % f->tcpDiedReadingQuery % f->tcpDiedSendingResponse % f->tcpGaveUp % f->tcpClientTimeouts % f->tcpDownstreamTimeouts % f->tcpAvgQueriesPerConnection % f->tcpAvgConnectionDuration % f->tlsNewSessions % f->tlsResumptions) << endl;
+ ret << (fmt % counter % f->local.toStringWithPort() % f->tcpCurrentConnections % f->tcpDiedReadingQuery % f->tcpDiedSendingResponse % f->tcpGaveUp % f->tcpClientTimeouts % f->tcpDownstreamTimeouts % f->tcpAvgQueriesPerConnection % f->tcpAvgConnectionDuration % f->tlsNewSessions % f->tlsResumptions % f->tls10queries % f->tls11queries % f->tls12queries % f->tls13queries % f->tlsUnknownqueries) << endl;
++counter;
}
ret << endl;
setLuaNoSideEffect();
try {
ostringstream ret;
- boost::format fmt("%-3d %-20.20s %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d");
- ret << (fmt % "#" % "Address" % "HTTP" % "HTTP/1" % "HTTP/2" % "TLS 1.0" % "TLS 1.1" % "TLS 1.2" % "TLS 1.3" % "TLS other" % "GET" % "POST" % "Bad" % "Errors" % "Redirects" % "Valid") << endl;
+ boost::format fmt("%-3d %-20.20s %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d %-15d");
+ ret << (fmt % "#" % "Address" % "HTTP" % "HTTP/1" % "HTTP/2" % "GET" % "POST" % "Bad" % "Errors" % "Redirects" % "Valid") << endl;
size_t counter = 0;
for (const auto& ctx : g_dohlocals) {
- ret << (fmt % counter % ctx->d_local.toStringWithPort() % ctx->d_httpconnects % ctx->d_http1Stats.d_nbQueries % ctx->d_http1Stats.d_nbQueries % ctx->d_tls10queries % ctx->d_tls11queries % ctx->d_tls12queries % ctx->d_tls13queries % ctx->d_tlsUnknownqueries % ctx->d_getqueries % ctx->d_postqueries % ctx->d_badrequests % ctx->d_errorresponses % ctx->d_redirectresponses % ctx->d_validresponses) << endl;
+ ret << (fmt % counter % ctx->d_local.toStringWithPort() % ctx->d_httpconnects % ctx->d_http1Stats.d_nbQueries % ctx->d_http1Stats.d_nbQueries % ctx->d_getqueries % ctx->d_postqueries % ctx->d_badrequests % ctx->d_errorresponses % ctx->d_redirectresponses % ctx->d_validresponses) << endl;
counter++;
}
g_outputBuffer = ret.str();
++state->d_ci.cs->queries;
++g_stats.queries;
+ if (state->d_handler.isTLS()) {
+ auto tlsVersion = state->d_handler.getTLSVersion();
+ switch (tlsVersion) {
+ case LibsslTLSVersion::TLS10:
+ ++state->d_ci.cs->tls10queries;
+ break;
+ case LibsslTLSVersion::TLS11:
+ ++state->d_ci.cs->tls11queries;
+ break;
+ case LibsslTLSVersion::TLS12:
+ ++state->d_ci.cs->tls12queries;
+ break;
+ case LibsslTLSVersion::TLS13:
+ ++state->d_ci.cs->tls13queries;
+ break;
+ default:
+ ++state->d_ci.cs->tlsUnknownqueries;
+ }
+ }
+
/* we need an accurate ("real") value for the response and
to store into the IDS, but not for insertion into the
rings for example */
output << "# TYPE " << frontsbase << "tlsnewsessions " << "counter" << "\n";
output << "# HELP " << frontsbase << "tlsresumptions " << "Amount of TLS sessions resumed" << "\n";
output << "# TYPE " << frontsbase << "tlsresumptions " << "counter" << "\n";
+ output << "# HELP " << frontsbase << "tlsqueries " << "Number of queries received by dnsdist over TLS, by TLS version" << "\n";
+ output << "# TYPE " << frontsbase << "tlsqueries " << "counter" << "\n";
std::map<std::string,uint64_t> frontendDuplicates;
for (const auto& front : g_frontends) {
output << frontsbase << "tcpavgconnectionduration" << label << front->tcpAvgConnectionDuration.load() << "\n";
output << frontsbase << "tlsnewsessions" << label << front->tlsNewSessions.load() << "\n";
output << frontsbase << "tlsresumptions" << label << front->tlsResumptions.load() << "\n";
+
+ output << frontsbase << "tlsqueries{frontend=\"" << frontName << "\",proto=\"" << proto << "\",tls=\"tls10\"} " << front->tls10queries.load() << "\n";
+ output << frontsbase << "tlsqueries{frontend=\"" << frontName << "\",proto=\"" << proto << "\",tls=\"tls11\"} " << front->tls11queries.load() << "\n";
+ output << frontsbase << "tlsqueries{frontend=\"" << frontName << "\",proto=\"" << proto << "\",tls=\"tls12\"} " << front->tls12queries.load() << "\n";
+ output << frontsbase << "tlsqueries{frontend=\"" << frontName << "\",proto=\"" << proto << "\",tls=\"tls13\"} " << front->tls13queries.load() << "\n";
+ output << frontsbase << "tlsqueries{frontend=\"" << frontName << "\",proto=\"" << proto << "\",tls=\"unknown\"} " << front->tlsUnknownqueries.load() << "\n";
}
}
output << "# HELP " << frontsbase << "http_connects " << "Number of DoH TCP connections established to this frontend" << "\n";
output << "# TYPE " << frontsbase << "http_connects " << "counter" << "\n";
- output << "# HELP " << frontsbase << "doh_tls_queries " << "Number of DoH queries received by dnsdist, by TLS version" << "\n";
- output << "# TYPE " << frontsbase << "doh_tls_queries " << "counter" << "\n";
-
output << "# HELP " << frontsbase << "doh_http_method_queries " << "Number of DoH queries received by dnsdist, by HTTP method" << "\n";
output << "# TYPE " << frontsbase << "doh_http_method_queries " << "counter" << "\n";
const std::string label = "{" + addrlabel + "} ";
output << frontsbase << "http_connects" << label << doh->d_httpconnects << "\n";
-
- output << frontsbase << "doh_tls_queries{tls=\"tls10\"," << addrlabel << "} " << doh->d_tls10queries << "\n";
- output << frontsbase << "doh_tls_queries{tls=\"tls11\"," << addrlabel << "} " << doh->d_tls11queries << "\n";
- output << frontsbase << "doh_tls_queries{tls=\"tls12\"," << addrlabel << "} " << doh->d_tls12queries << "\n";
- output << frontsbase << "doh_tls_queries{tls=\"tls13\"," << addrlabel << "} " << doh->d_tls13queries << "\n";
- output << frontsbase << "doh_tls_queries{tls=\"unknown\"," << addrlabel << "} " << doh->d_tlsUnknownqueries << "\n";
-
output << frontsbase << "doh_http_method_queries{method=\"get\"," << addrlabel << "} " << doh->d_getqueries << "\n";
output << frontsbase << "doh_http_method_queries{method=\"post\"," << addrlabel << "} " << doh->d_postqueries << "\n";
{ "http2-502-responses", (double) doh->d_http2Stats.d_nb502Responses },
{ "http1-other-responses", (double) doh->d_http1Stats.d_nbOtherResponses },
{ "http2-other-responses", (double) doh->d_http2Stats.d_nbOtherResponses },
- { "tls10-queries", (double) doh->d_tls10queries },
- { "tls11-queries", (double) doh->d_tls11queries },
- { "tls12-queries", (double) doh->d_tls12queries },
- { "tls13-queries", (double) doh->d_tls13queries },
- { "tls-unknown-queries", (double) doh->d_tlsUnknownqueries },
{ "get-queries", (double) doh->d_getqueries },
{ "post-queries", (double) doh->d_postqueries },
{ "bad-requests", (double) doh->d_badrequests },
std::atomic<uint64_t> tcpCurrentConnections{0};
std::atomic<uint64_t> tlsNewSessions{0}; // A new TLS session has been negotiated, no resumption
std::atomic<uint64_t> tlsResumptions{0}; // A TLS session has been resumed, either via session id or via a TLS ticket
+ std::atomic<uint64_t> tls10queries{0}; // valid DNS queries received via TLSv1.0
+ std::atomic<uint64_t> tls11queries{0}; // valid DNS queries received via TLSv1.1
+ std::atomic<uint64_t> tls12queries{0}; // valid DNS queries received via TLSv1.2
+ std::atomic<uint64_t> tls13queries{0}; // valid DNS queries received via TLSv1.3
+ std::atomic<uint64_t> tlsUnknownqueries{0}; // valid DNS queries received via unknown TLS version
std::atomic<double> tcpAvgQueriesPerConnection{0.0};
/* in ms */
if(auto tlsversion = h2o_socket_get_ssl_protocol_version(sock)) {
if(!strcmp(tlsversion, "TLSv1.0"))
- ++dsc->df->d_tls10queries;
+ ++dsc->cs->tls10queries;
else if(!strcmp(tlsversion, "TLSv1.1"))
- ++dsc->df->d_tls11queries;
+ ++dsc->cs->tls11queries;
else if(!strcmp(tlsversion, "TLSv1.2"))
- ++dsc->df->d_tls12queries;
+ ++dsc->cs->tls12queries;
else if(!strcmp(tlsversion, "TLSv1.3"))
- ++dsc->df->d_tls13queries;
+ ++dsc->cs->tls13queries;
else
- ++dsc->df->d_tlsUnknownqueries;
+ ++dsc->cs->tlsUnknownqueries;
}
string path(req->path.base, req->path.len);
}
}
- std::string getServerNameIndication() override
+ std::string getServerNameIndication() const override
{
if (d_conn) {
const char* value = SSL_get_servername(d_conn.get(), TLSEXT_NAMETYPE_host_name);
return std::string();
}
+ LibsslTLSVersion getTLSVersion() const override
+ {
+ auto proto = SSL_version(d_conn.get());
+ switch (proto) {
+ case TLS1_VERSION:
+ return LibsslTLSVersion::TLS10;
+ case TLS1_1_VERSION:
+ return LibsslTLSVersion::TLS11;
+ case TLS1_2_VERSION:
+ return LibsslTLSVersion::TLS12;
+#ifdef TLS1_3_VERSION
+ case TLS1_3_VERSION:
+ return LibsslTLSVersion::TLS13;
+#endif /* TLS1_3_VERSION */
+ default:
+ return LibsslTLSVersion::Unknown;
+ }
+ }
+
bool hasSessionBeenResumed() const override
{
if (d_conn) {
return got;
}
- std::string getServerNameIndication() override
+ std::string getServerNameIndication() const override
{
if (d_conn) {
unsigned int type;
return std::string();
}
+ LibsslTLSVersion getTLSVersion() const override
+ {
+ auto proto = gnutls_protocol_get_version(d_conn.get());
+ switch (proto) {
+ case GNUTLS_TLS1_0:
+ return LibsslTLSVersion::TLS10;
+ case GNUTLS_TLS1_1:
+ return LibsslTLSVersion::TLS11;
+ case GNUTLS_TLS1_2:
+ return LibsslTLSVersion::TLS12;
+#if GNUTLS_VERSION_NUMBER >= 0x030603
+ case GNUTLS_TLS1_3:
+ return LibsslTLSVersion::TLS13;
+#endif /* GNUTLS_VERSION_NUMBER >= 0x030603 */
+ default:
+ return LibsslTLSVersion::Unknown;
+ }
+ }
+
bool hasSessionBeenResumed() const override
{
if (d_conn) {
uint8_t d_numberOfTicketsKeys{5};
bool d_enableTickets{true};
- std::atomic<uint64_t> d_httpconnects; // number of TCP/IP connections established
- std::atomic<uint64_t> d_tls10queries; // valid DNS queries received via TLSv1.0
- std::atomic<uint64_t> d_tls11queries; // valid DNS queries received via TLSv1.1
- std::atomic<uint64_t> d_tls12queries; // valid DNS queries received via TLSv1.2
- std::atomic<uint64_t> d_tls13queries; // valid DNS queries received via TLSv1.3
- std::atomic<uint64_t> d_tlsUnknownqueries; // valid DNS queries received via unknown TLS version
-
- std::atomic<uint64_t> d_getqueries; // valid DNS queries received via GET
- std::atomic<uint64_t> d_postqueries; // valid DNS queries received via POST
- std::atomic<uint64_t> d_badrequests; // request could not be converted to dns query
- std::atomic<uint64_t> d_errorresponses; // dnsdist set 'error' on response
- std::atomic<uint64_t> d_redirectresponses; // dnsdist set 'redirect' on response
- std::atomic<uint64_t> d_validresponses; // valid responses sent out
+ std::atomic<uint64_t> d_httpconnects{0}; // number of TCP/IP connections established
+ std::atomic<uint64_t> d_getqueries{0}; // valid DNS queries received via GET
+ std::atomic<uint64_t> d_postqueries{0}; // valid DNS queries received via POST
+ std::atomic<uint64_t> d_badrequests{0}; // request could not be converted to dns query
+ std::atomic<uint64_t> d_errorresponses{0}; // dnsdist set 'error' on response
+ std::atomic<uint64_t> d_redirectresponses{0}; // dnsdist set 'redirect' on response
+ std::atomic<uint64_t> d_validresponses{0}; // valid responses sent out
struct HTTPVersionStats
{
#include "circular_buffer.hh"
#include "lock.hh"
-enum class LibsslTLSVersion { TLS10, TLS11, TLS12, TLS13 };
+enum class LibsslTLSVersion { Unknown, TLS10, TLS11, TLS12, TLS13 };
#ifdef HAVE_LIBSSL
#include <openssl/ssl.h>
virtual size_t write(const void* buffer, size_t bufferSize, unsigned int writeTimeout) = 0;
virtual IOState tryWrite(std::vector<uint8_t>& buffer, size_t& pos, size_t toWrite) = 0;
virtual IOState tryRead(std::vector<uint8_t>& buffer, size_t& pos, size_t toRead) = 0;
- virtual std::string getServerNameIndication() = 0;
+ virtual std::string getServerNameIndication() const = 0;
+ virtual LibsslTLSVersion getTLSVersion() const = 0;
virtual bool hasSessionBeenResumed() const = 0;
virtual void close() = 0;
}
}
- std::string getServerNameIndication()
+ std::string getServerNameIndication() const
{
if (d_conn) {
return d_conn->getServerNameIndication();
return std::string();
}
+ LibsslTLSVersion getTLSVersion() const
+ {
+ if (d_conn) {
+ return d_conn->getTLSVersion();
+ }
+ return LibsslTLSVersion::Unknown;
+ }
+
bool isTLS() const
{
return d_conn != nullptr;
projects / pdns / commitdiff