All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hannes Reinecke <hare@suse.de>
To: Christoph Hellwig <hch@lst.de>
Cc: Sagi Grimberg <sagi@grimberg.me>, Keith Busch <kbusch@kernel.org>,
	linux-nvme@lists.infradead.org, Jakub Kicinski <kuba@kernel.org>,
	Eric Dumazet <edumazet@google.com>,
	Paolo Abeni <pabeni@redhat.com>,
	netdev@vger.kernel.org, Hannes Reinecke <hare@suse.de>
Subject: [PATCH 15/18] nvmet: Set 'TREQ' to 'required' when TLS is enabled
Date: Wed, 16 Aug 2023 14:06:05 +0200	[thread overview]
Message-ID: <20230816120608.37135-16-hare@suse.de> (raw)
In-Reply-To: <20230816120608.37135-1-hare@suse.de>

The current implementation does not support secure concatenation,
so 'TREQ' is always set to 'required' when TLS is enabled.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
---
 drivers/nvme/target/configfs.c | 15 +++++++++++++--
 drivers/nvme/target/nvmet.h    |  5 +++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 27a0f9c768e8..483569c3f622 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -166,8 +166,7 @@ static inline u8 nvmet_port_disc_addr_treq_mask(struct nvmet_port *port)
 
 static ssize_t nvmet_addr_treq_show(struct config_item *item, char *page)
 {
-	u8 treq = to_nvmet_port(item)->disc_addr.treq &
-		NVME_TREQ_SECURE_CHANNEL_MASK;
+	u8 treq = nvmet_port_disc_addr_treq_secure_channel(to_nvmet_port(item));
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(nvmet_addr_treq); i++) {
@@ -376,6 +375,7 @@ static ssize_t nvmet_addr_tsas_store(struct config_item *item,
 		const char *page, size_t count)
 {
 	struct nvmet_port *port = to_nvmet_port(item);
+	u8 treq = nvmet_port_disc_addr_treq_mask(port);
 	u8 sectype;
 	int i;
 
@@ -397,6 +397,17 @@ static ssize_t nvmet_addr_tsas_store(struct config_item *item,
 
 found:
 	nvmet_port_init_tsas_tcp(port, sectype);
+	/*
+	 * The TLS implementation currently does not support
+	 * secure concatenation, so TREQ is always set to 'required'
+	 * if TLS is enabled.
+	 */
+	if (sectype == NVMF_TCP_SECTYPE_TLS13) {
+		treq |= NVMF_TREQ_REQUIRED;
+	} else {
+		treq |= NVMF_TREQ_NOT_SPECIFIED;
+	}
+	port->disc_addr.treq = treq;
 	return count;
 }
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 8cfd60f3b564..87da62e4b743 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -178,6 +178,11 @@ static inline struct nvmet_port *ana_groups_to_port(
 			ana_groups_group);
 }
 
+static inline u8 nvmet_port_disc_addr_treq_secure_channel(struct nvmet_port *port)
+{
+	return (port->disc_addr.treq & NVME_TREQ_SECURE_CHANNEL_MASK);
+}
+
 struct nvmet_ctrl {
 	struct nvmet_subsys	*subsys;
 	struct nvmet_sq		**sqs;
-- 
2.35.3



  parent reply	other threads:[~2023-08-16 12:06 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-08-16 12:05 [PATCHv10 00/18] nvme: In-kernel TLS support for TCP Hannes Reinecke
2023-08-16 12:05 ` [PATCH 01/18] nvme-keyring: register '.nvme' keyring Hannes Reinecke
2023-08-16 12:05 ` [PATCH 02/18] nvme-keyring: define a 'psk' keytype Hannes Reinecke
2023-08-16 12:05 ` [PATCH 03/18] nvme: add TCP TSAS definitions Hannes Reinecke
2023-08-16 12:05 ` [PATCH 04/18] nvme-tcp: add definitions for TLS cipher suites Hannes Reinecke
2023-08-16 12:05 ` [PATCH 05/18] nvme-keyring: implement nvme_tls_psk_default() Hannes Reinecke
2023-08-16 12:05 ` [PATCH 06/18] security/keys: export key_lookup() Hannes Reinecke
2023-08-16 12:05 ` [PATCH 07/18] nvme-tcp: allocate socket file Hannes Reinecke
2023-08-16 12:05 ` [PATCH 08/18] nvme-tcp: enable TLS handshake upcall Hannes Reinecke
2023-08-16 12:05 ` [PATCH 09/18] nvme-tcp: control message handling for recvmsg() Hannes Reinecke
2023-08-16 12:06 ` [PATCH 10/18] nvme-tcp: improve icreq/icresp logging Hannes Reinecke
2023-08-17 10:44   ` Sagi Grimberg
2023-08-18 11:50   ` Nitesh Shetty
2023-08-16 12:06 ` [PATCH 11/18] nvme-fabrics: parse options 'keyring' and 'tls_key' Hannes Reinecke
2023-08-17  9:20   ` Sagi Grimberg
2023-08-17  9:46     ` Hannes Reinecke
2023-08-17 10:41       ` Sagi Grimberg
2023-08-16 12:06 ` [PATCH 12/18] nvmet: make TCP sectype settable via configfs Hannes Reinecke
2023-08-16 12:06 ` [PATCH 13/18] nvmet-tcp: make nvmet_tcp_alloc_queue() a void function Hannes Reinecke
2023-08-18  9:59   ` Nitesh Shetty
2023-08-16 12:06 ` [PATCH 14/18] nvmet-tcp: allocate socket file Hannes Reinecke
2023-08-16 12:06 ` Hannes Reinecke [this message]
2023-08-16 12:06 ` [PATCH 16/18] nvmet-tcp: enable TLS handshake upcall Hannes Reinecke
2023-08-20 14:55   ` Sagi Grimberg
2023-08-22  6:16     ` Hannes Reinecke
2023-08-16 12:06 ` [PATCH 17/18] nvmet-tcp: control messages for recvmsg() Hannes Reinecke
2023-08-16 12:06 ` [PATCH 18/18] nvmet-tcp: peek icreq before starting TLS Hannes Reinecke
  -- strict thread matches above, loose matches on Subject: below --
2023-08-24 14:39 [PATCHv11 00/18] nvme: In-kernel TLS support for TCP Hannes Reinecke
2023-08-24 14:39 ` [PATCH 15/18] nvmet: Set 'TREQ' to 'required' when TLS is enabled Hannes Reinecke

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230816120608.37135-16-hare@suse.de \
    --to=hare@suse.de \
    --cc=edumazet@google.com \
    --cc=hch@lst.de \
    --cc=kbusch@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-nvme@lists.infradead.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=sagi@grimberg.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.