From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F033FC04A6A for ; Tue, 8 Aug 2023 16:54:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=gCMg4Tov/I81WFhZwGo3jc91nWtVegpSIluzB/oEEr0=; b=QBqgEBHe8e/laH+P6UnIaEcUOu vB8fQcEeS3yMVEj0xLbBxjRWjruWJNt4gFxf+HGH8XjMbPK5j4+tAUB5e2UYho7Im7E3xPWW+Rs4U ilWAVOGZp1e+aBvCpPX0lxUX9ESUkUhTvuq85N979Euvg5dKu5rPBe0qfX3lvR5DbuApm+Gsm5zLA WuN58VNaHdpcf+Rqd+3RoM77aVZ8u14y8D0JwFjMZDPIY1ElGjDsIXl7P0p0p6wjivfw7/nEb5REv J0ZN3bAlzfyLrl0Nr4P/VrP/ZmFtZMKIgt01Yf9R7lgyw0b/yZO0fsQH8dstngzCias3MIW85wyiO U1myknpw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qTPya-0032E5-2z; Tue, 08 Aug 2023 16:54:32 +0000 Received: from smtp-out2.suse.de ([2001:67c:2178:6::1d]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qTPyL-0031zD-1l for linux-nvme@lists.infradead.org; Tue, 08 Aug 2023 16:54:21 +0000 Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out2.suse.de (Postfix) with ESMTP id 4E23A1F381; Tue, 8 Aug 2023 16:54:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1691513648; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gCMg4Tov/I81WFhZwGo3jc91nWtVegpSIluzB/oEEr0=; b=tSNrNaOF6/c0cosZ+WjCry2SWz0uYBjpVRl2XM7g7+AhQMEC4l2ZrY38o3I8Uy27rO3+KM CS5PFSbL8izSalzilkFZurP95ChKbIOL1y0vS4VOhlXT3gJTnmWWi+Bvs0X5s91v5g6FzP 64jIz6D1M5Y6Y576qvx0AiD+gC00vSI= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1691513648; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gCMg4Tov/I81WFhZwGo3jc91nWtVegpSIluzB/oEEr0=; b=HfXTOF/iqvPBEMHOZLaZ0QVfFAUaRnCO70xg1kQ6cMXirU41OuKUO19hJZsnCL44Zd9Mp0 7LUe2WlFVu14PxCA== Received: from adalid.arch.suse.de (adalid.arch.suse.de [10.161.8.13]) by relay2.suse.de (Postfix) with ESMTP id 416742C15A; Tue, 8 Aug 2023 16:54:08 +0000 (UTC) Received: by adalid.arch.suse.de (Postfix, from userid 16045) id 3E03E51CACF9; Tue, 8 Aug 2023 18:54:08 +0200 (CEST) From: Hannes Reinecke To: Christoph Hellwig Cc: Sagi Grimberg , Keith Busch , linux-nvme@lists.infradead.org, Hannes Reinecke Subject: [PATCH 10/16] nvme-fabrics: parse options 'keyring' and 'tls_key' Date: Tue, 8 Aug 2023 18:53:48 +0200 Message-Id: <20230808165354.123499-11-hare@suse.de> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20230808165354.123499-1-hare@suse.de> References: <20230808165354.123499-1-hare@suse.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230808_095417_728430_21D0E7E5 X-CRM114-Status: GOOD ( 18.00 ) X-BeenThere: linux-nvme@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-nvme" Errors-To: linux-nvme-bounces+linux-nvme=archiver.kernel.org@lists.infradead.org Parse the fabrics options 'keyring' and 'tls_key' and store the referenced keys in the options structure. Signed-off-by: Hannes Reinecke --- drivers/nvme/host/fabrics.c | 71 ++++++++++++++++++++++++++++++++++++- drivers/nvme/host/fabrics.h | 6 ++++ drivers/nvme/host/tcp.c | 11 ++++-- 3 files changed, 84 insertions(+), 4 deletions(-) diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c index ddad482c3537..df986a7641a3 100644 --- a/drivers/nvme/host/fabrics.c +++ b/drivers/nvme/host/fabrics.c @@ -622,6 +622,41 @@ static struct nvmf_transport_ops *nvmf_lookup_transport( return NULL; } +static int parse_key(struct nvmf_ctrl_options *opts, int key_id, + bool is_key) +{ + struct key *key = NULL; + + if (key_id < 0) { + pr_err("Invalid %s id %d\n", + is_key ? "key" : "keyring", key_id); + return -EINVAL; + } + if (key_id) { + key = key_lookup(key_id); + if (!key) { + pr_err("%s id %08x not found\n", + is_key ? "Key" : "Keyring", key_id); + return -ENOKEY; + } + } else { + if (is_key) + pr_debug("Using 'best' PSK\n"); + else + pr_debug("Using default keyring\n"); + key = NULL; + } + if (is_key) { + key_put(opts->tls_key); + opts->tls_key = key; + } else { + key_put(opts->keyring); + opts->keyring = key; + } + + return 0; +} + static const match_table_t opt_tokens = { { NVMF_OPT_TRANSPORT, "transport=%s" }, { NVMF_OPT_TRADDR, "traddr=%s" }, @@ -643,6 +678,10 @@ static const match_table_t opt_tokens = { { NVMF_OPT_NR_WRITE_QUEUES, "nr_write_queues=%d" }, { NVMF_OPT_NR_POLL_QUEUES, "nr_poll_queues=%d" }, { NVMF_OPT_TOS, "tos=%d" }, +#ifdef CONFIG_NVME_TCP_TLS + { NVMF_OPT_KEYRING, "keyring=%d" }, + { NVMF_OPT_TLS_KEY, "tls_key=%d" }, +#endif { NVMF_OPT_FAIL_FAST_TMO, "fast_io_fail_tmo=%d" }, { NVMF_OPT_DISCOVERY, "discovery" }, { NVMF_OPT_DHCHAP_SECRET, "dhchap_secret=%s" }, @@ -660,7 +699,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, char *options, *o, *p; int token, ret = 0; size_t nqnlen = 0; - int ctrl_loss_tmo = NVMF_DEF_CTRL_LOSS_TMO; + int ctrl_loss_tmo = NVMF_DEF_CTRL_LOSS_TMO, key_id; uuid_t hostid; char hostnqn[NVMF_NQN_SIZE]; @@ -928,6 +967,34 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, } opts->tos = token; break; + case NVMF_OPT_KEYRING: + if (!IS_ENABLED(CONFIG_NVME_TCP_TLS)) { + pr_err("TLS is not supported\n"); + ret = -EINVAL; + goto out; + } + if (match_int(args, &key_id)) { + ret = -EINVAL; + goto out; + } + ret = parse_key(opts, key_id, false); + if (ret < 0) + goto out; + break; + case NVMF_OPT_TLS_KEY: + if (!IS_ENABLED(CONFIG_NVME_TCP_TLS)) { + pr_err("TLS is not supported\n"); + ret = -EINVAL; + goto out; + } + if (match_int(args, &key_id)) { + ret = -EINVAL; + goto out; + } + ret = parse_key(opts, key_id, true); + if (ret < 0) + goto out; + break; case NVMF_OPT_DISCOVERY: opts->discovery_nqn = true; break; @@ -1168,6 +1235,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts, void nvmf_free_options(struct nvmf_ctrl_options *opts) { nvmf_host_put(opts->host); + key_put(opts->keyring); + key_put(opts->tls_key); kfree(opts->transport); kfree(opts->traddr); kfree(opts->trsvcid); diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h index dac17c3fee26..fbaee5a7be19 100644 --- a/drivers/nvme/host/fabrics.h +++ b/drivers/nvme/host/fabrics.h @@ -71,6 +71,8 @@ enum { NVMF_OPT_DHCHAP_SECRET = 1 << 23, NVMF_OPT_DHCHAP_CTRL_SECRET = 1 << 24, NVMF_OPT_TLS = 1 << 25, + NVMF_OPT_KEYRING = 1 << 26, + NVMF_OPT_TLS_KEY = 1 << 27, }; /** @@ -103,6 +105,8 @@ enum { * @dhchap_secret: DH-HMAC-CHAP secret * @dhchap_ctrl_secret: DH-HMAC-CHAP controller secret for bi-directional * authentication + * @keyring: Keyring to use for key lookups + * @tls_key: TLS key for encrypted connections (TCP) * @tls: Start TLS encrypted connections (TCP) * @disable_sqflow: disable controller sq flow control * @hdr_digest: generate/verify header digest (TCP) @@ -130,6 +134,8 @@ struct nvmf_ctrl_options { struct nvmf_host *host; char *dhchap_secret; char *dhchap_ctrl_secret; + struct key *keyring; + struct key *tls_key; bool tls; bool disable_sqflow; bool hdr_digest; diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 3382e85b7759..636cff51ef6e 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -1583,6 +1583,8 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl, dev_dbg(nctrl->device, "queue %d: start TLS with key %x\n", qid, pskid); + if (nctrl->opts->keyring) + keyring = key_serial(nctrl->opts->keyring); memset(&args, 0, sizeof(args)); args.ta_sock = queue->sock; args.ta_done = nvme_tcp_tls_done; @@ -1909,9 +1911,12 @@ static int nvme_tcp_alloc_admin_queue(struct nvme_ctrl *ctrl) key_serial_t pskid = 0; if (ctrl->opts->tls) { - pskid = nvme_tls_psk_default(NULL, - ctrl->opts->host->nqn, - ctrl->opts->subsysnqn); + if (ctrl->opts->tls_key) + pskid = key_serial(ctrl->opts->tls_key); + else + pskid = nvme_tls_psk_default(ctrl->opts->keyring, + ctrl->opts->host->nqn, + ctrl->opts->subsysnqn); if (!pskid) { dev_err(ctrl->device, "no valid PSK found\n"); ret = -ENOKEY; -- 2.35.3