* [PATCH 00/12] nvme-auth: switch to use the kernel keyring
@ 2025-04-25 9:49 Hannes Reinecke
2025-04-25 9:49 ` [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status Hannes Reinecke
` (13 more replies)
0 siblings, 14 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Hey all,
the current NVMe authentication code is using a hand-crafted key structure;
idea was to have the initial implementation with a minimal set of dependencies.
(And me not having a good grasp on how to use the kernel keyring :-)
That had the drawback that keys always had to be specified on the nvme-cli
commandline, which is far from ideal from a security standpoint.
So this patchset switches the authentication code over to use the kernel keyring.
User-facing interface (namely argument to 'nvme connect') remain the same, but
the key data is converted into keys which are stored as a new key type 'dhchap'
with a random UUID as description in the kernel keyring.
With this I have updated the dhchap arguments to 'nvme connect' and the configfs
interface to either be the keydata (ie the original interface) _or_ a key serial
referring to a pre-populated dhchap key in the kernel keyring.
This allows for easier provisioning of keys and avoids the security risk from
having to specify the key data on the kernel commandline.
The entire patchset can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/hare/nvme.git
branch dhchap-keyring.v1
As usual, comments and reviews are welcome.
Hannes Reinecke (12):
nvme-auth: modify nvme_auth_transform_key() to return status
nvme-auth: use SHASH_DESC_ON_STACK
nvmet-auth: use SHASH_DESC_ON_STACK
nvme-auth: do not cache the transformed secret
nvme-keyring: add 'dhchap' key type
nvme-auth: switch to use 'struct key'
nvme-auth: drop nvme_dhchap_key structure and unused functions
nvme: parse dhchap keys during option parsing
nvmet-auth: parse dhchap key from configfs attribute
nvme: allow to pass in key serial number as dhchap secret
nvme-auth: wait for authentication to finish when changing keys
nvme: Unify Kconfig settings
drivers/nvme/common/Kconfig | 1 +
drivers/nvme/common/auth.c | 245 +++++++++++++-----------------
drivers/nvme/common/keyring.c | 266 +++++++++++++++++++++++++++++++++
drivers/nvme/host/Kconfig | 4 +-
drivers/nvme/host/auth.c | 171 ++++++++++++++-------
drivers/nvme/host/fabrics.c | 94 +++++++++---
drivers/nvme/host/fabrics.h | 12 +-
drivers/nvme/host/nvme.h | 6 +-
drivers/nvme/host/sysfs.c | 204 ++++++++++++++++++-------
drivers/nvme/target/Kconfig | 3 +-
drivers/nvme/target/auth.c | 238 ++++++++++++++++++-----------
drivers/nvme/target/configfs.c | 61 ++++++--
drivers/nvme/target/nvmet.h | 13 +-
include/linux/nvme-auth.h | 18 +--
include/linux/nvme-keyring.h | 22 ++-
15 files changed, 948 insertions(+), 410 deletions(-)
--
2.35.3
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-05-07 7:24 ` Christoph Hellwig
2025-04-25 9:49 ` [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK Hannes Reinecke
` (12 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Modify nvme_auth_transform_key() to return a status and provide
the transformed data as argument on the command line as raw data.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/common/auth.c | 80 +++++++++++++++++++++++---------------
drivers/nvme/host/auth.c | 40 ++++++++++---------
drivers/nvme/target/auth.c | 36 ++++++++---------
include/linux/nvme-auth.h | 4 +-
4 files changed, 89 insertions(+), 71 deletions(-)
diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index 2c092ec8c0a9..d6dfc4ff39a2 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -237,81 +237,97 @@ void nvme_auth_free_key(struct nvme_dhchap_key *key)
}
EXPORT_SYMBOL_GPL(nvme_auth_free_key);
-struct nvme_dhchap_key *nvme_auth_transform_key(
- struct nvme_dhchap_key *key, char *nqn)
+int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
+ u8 **transformed_secret)
{
const char *hmac_name;
struct crypto_shash *key_tfm;
struct shash_desc *shash;
- struct nvme_dhchap_key *transformed_key;
- int ret, key_len;
+ u8 *transformed_data;
+ u8 *key_data;
+ size_t transformed_len;
+ int ret;
if (!key) {
pr_warn("No key specified\n");
- return ERR_PTR(-ENOKEY);
+ return -ENOKEY;
}
+ key_data = kzalloc(key->len, GFP_KERNEL);
+ if (!key_data)
+ return -ENOMEM;
+ memcpy(key_data, key->key, key->len);
if (key->hash == 0) {
- key_len = nvme_auth_key_struct_size(key->len);
- transformed_key = kmemdup(key, key_len, GFP_KERNEL);
- if (!transformed_key)
- return ERR_PTR(-ENOMEM);
- return transformed_key;
+ *transformed_secret = key_data;
+ return key->len;
}
hmac_name = nvme_auth_hmac_name(key->hash);
if (!hmac_name) {
pr_warn("Invalid key hash id %d\n", key->hash);
- return ERR_PTR(-EINVAL);
+ ret = -EINVAL;
+ goto out_free_data;
}
key_tfm = crypto_alloc_shash(hmac_name, 0, 0);
- if (IS_ERR(key_tfm))
- return ERR_CAST(key_tfm);
+ if (IS_ERR(key_tfm)) {
+ ret = PTR_ERR(key_tfm);
+ goto out_free_data;
+ }
+
+ transformed_len = crypto_shash_digestsize(key_tfm);
+ if (transformed_len != key->len) {
+ pr_warn("incompatible digest size %ld for key (hash %s, len %ld)\n",
+ transformed_len, hmac_name, key->len);
+ ret = -EINVAL;
+ goto out_free_tfm;
+ }
+
+ transformed_data = kzalloc(transformed_len, GFP_KERNEL);
+ if (!transformed_data) {
+ ret = -ENOMEM;
+ goto out_free_tfm;
+ }
shash = kmalloc(sizeof(struct shash_desc) +
crypto_shash_descsize(key_tfm),
GFP_KERNEL);
if (!shash) {
ret = -ENOMEM;
- goto out_free_key;
- }
-
- key_len = crypto_shash_digestsize(key_tfm);
- transformed_key = nvme_auth_alloc_key(key_len, key->hash);
- if (!transformed_key) {
- ret = -ENOMEM;
- goto out_free_shash;
+ goto out_free_transformed_data;
}
shash->tfm = key_tfm;
ret = crypto_shash_setkey(key_tfm, key->key, key->len);
if (ret < 0)
- goto out_free_transformed_key;
+ goto out_free_shash;
ret = crypto_shash_init(shash);
if (ret < 0)
- goto out_free_transformed_key;
+ goto out_free_shash;
ret = crypto_shash_update(shash, nqn, strlen(nqn));
if (ret < 0)
- goto out_free_transformed_key;
+ goto out_free_shash;
ret = crypto_shash_update(shash, "NVMe-over-Fabrics", 17);
if (ret < 0)
- goto out_free_transformed_key;
- ret = crypto_shash_final(shash, transformed_key->key);
+ goto out_free_shash;
+ ret = crypto_shash_final(shash, transformed_data);
if (ret < 0)
- goto out_free_transformed_key;
+ goto out_free_shash;
kfree(shash);
crypto_free_shash(key_tfm);
+ *transformed_secret = transformed_data;
- return transformed_key;
+ return transformed_len;
-out_free_transformed_key:
- nvme_auth_free_key(transformed_key);
out_free_shash:
kfree(shash);
-out_free_key:
+out_free_transformed_data:
+ kfree(transformed_data);
+out_free_tfm:
crypto_free_shash(key_tfm);
+out_free_data:
+ kfree(key_data);
- return ERR_PTR(ret);
+ return ret;
}
EXPORT_SYMBOL_GPL(nvme_auth_transform_key);
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 6115fef74c1e..4b6dc1dd5f66 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -24,7 +24,8 @@ struct nvme_dhchap_queue_context {
struct nvme_ctrl *ctrl;
struct crypto_shash *shash_tfm;
struct crypto_kpp *dh_tfm;
- struct nvme_dhchap_key *transformed_key;
+ u8 *transformed_secret;
+ size_t transformed_len;
void *buf;
int qid;
int error;
@@ -436,21 +437,20 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl,
dev_dbg(ctrl->device, "%s: qid %d host response seq %u transaction %d\n",
__func__, chap->qid, chap->s1, chap->transaction);
- if (!chap->transformed_key) {
- chap->transformed_key = nvme_auth_transform_key(ctrl->host_key,
- ctrl->opts->host->nqn);
- if (IS_ERR(chap->transformed_key)) {
- ret = PTR_ERR(chap->transformed_key);
- chap->transformed_key = NULL;
+ if (!chap->transformed_secret) {
+ ret = nvme_auth_transform_key(ctrl->host_key,
+ ctrl->opts->host->nqn,
+ &chap->transformed_secret);
+ if (ret < 0)
return ret;
- }
+ chap->transformed_len = ret;
} else {
dev_dbg(ctrl->device, "%s: qid %d re-using host response\n",
__func__, chap->qid);
}
ret = crypto_shash_setkey(chap->shash_tfm,
- chap->transformed_key->key, chap->transformed_key->len);
+ chap->transformed_secret, chap->transformed_len);
if (ret) {
dev_warn(ctrl->device, "qid %d: failed to set key, error %d\n",
chap->qid, ret);
@@ -516,19 +516,20 @@ static int nvme_auth_dhchap_setup_ctrl_response(struct nvme_ctrl *ctrl,
struct nvme_dhchap_queue_context *chap)
{
SHASH_DESC_ON_STACK(shash, chap->shash_tfm);
- struct nvme_dhchap_key *transformed_key;
+ u8 *transformed_secret;
+ size_t transformed_len;
u8 buf[4], *challenge = chap->c2;
int ret;
- transformed_key = nvme_auth_transform_key(ctrl->ctrl_key,
- ctrl->opts->subsysnqn);
- if (IS_ERR(transformed_key)) {
- ret = PTR_ERR(transformed_key);
+ ret = nvme_auth_transform_key(ctrl->ctrl_key,
+ ctrl->opts->subsysnqn,
+ &transformed_secret);
+ if (ret < 0)
return ret;
- }
+ transformed_len = ret;
ret = crypto_shash_setkey(chap->shash_tfm,
- transformed_key->key, transformed_key->len);
+ transformed_secret, transformed_len);
if (ret) {
dev_warn(ctrl->device, "qid %d: failed to set key, error %d\n",
chap->qid, ret);
@@ -594,7 +595,7 @@ static int nvme_auth_dhchap_setup_ctrl_response(struct nvme_ctrl *ctrl,
out:
if (challenge != chap->c2)
kfree(challenge);
- nvme_auth_free_key(transformed_key);
+ kfree(transformed_secret);
return ret;
}
@@ -656,8 +657,9 @@ static int nvme_auth_dhchap_exponential(struct nvme_ctrl *ctrl,
static void nvme_auth_reset_dhchap(struct nvme_dhchap_queue_context *chap)
{
- nvme_auth_free_key(chap->transformed_key);
- chap->transformed_key = NULL;
+ kfree(chap->transformed_secret);
+ chap->transformed_secret = NULL;
+ chap->transformed_len = 0;
kfree_sensitive(chap->host_key);
chap->host_key = NULL;
chap->host_key_len = 0;
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index cef8d77f477b..46a25b76544d 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -294,7 +294,8 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
struct nvmet_ctrl *ctrl = req->sq->ctrl;
const char *hash_name;
u8 *challenge = req->sq->dhchap_c1;
- struct nvme_dhchap_key *transformed_key;
+ u8 *transformed_secret;
+ size_t transformed_len;
u8 buf[4];
int ret;
@@ -318,15 +319,14 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
goto out_free_tfm;
}
- transformed_key = nvme_auth_transform_key(ctrl->host_key,
- ctrl->hostnqn);
- if (IS_ERR(transformed_key)) {
- ret = PTR_ERR(transformed_key);
+ ret = nvme_auth_transform_key(ctrl->host_key, ctrl->hostnqn,
+ &transformed_secret);
+ if (ret < 0)
goto out_free_tfm;
- }
- ret = crypto_shash_setkey(shash_tfm, transformed_key->key,
- transformed_key->len);
+ transformed_len = ret;
+ ret = crypto_shash_setkey(shash_tfm, transformed_secret,
+ transformed_len);
if (ret)
goto out_free_response;
@@ -394,7 +394,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
if (challenge != req->sq->dhchap_c1)
kfree(challenge);
out_free_response:
- nvme_auth_free_key(transformed_key);
+ kfree(transformed_secret);
out_free_tfm:
crypto_free_shash(shash_tfm);
return ret;
@@ -408,7 +408,8 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response,
struct nvmet_ctrl *ctrl = req->sq->ctrl;
const char *hash_name;
u8 *challenge = req->sq->dhchap_c2;
- struct nvme_dhchap_key *transformed_key;
+ u8 *transformed_secret;
+ size_t transformed_len;
u8 buf[4];
int ret;
@@ -432,15 +433,14 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response,
goto out_free_tfm;
}
- transformed_key = nvme_auth_transform_key(ctrl->ctrl_key,
- ctrl->subsysnqn);
- if (IS_ERR(transformed_key)) {
- ret = PTR_ERR(transformed_key);
+ ret = nvme_auth_transform_key(ctrl->ctrl_key, ctrl->subsysnqn,
+ &transformed_secret);
+ if (ret < 0)
goto out_free_tfm;
- }
+ transformed_len = ret;
- ret = crypto_shash_setkey(shash_tfm, transformed_key->key,
- transformed_key->len);
+ ret = crypto_shash_setkey(shash_tfm, transformed_secret,
+ transformed_len);
if (ret)
goto out_free_response;
@@ -505,7 +505,7 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response,
if (challenge != req->sq->dhchap_c2)
kfree(challenge);
out_free_response:
- nvme_auth_free_key(transformed_key);
+ kfree(transformed_secret);
out_free_tfm:
crypto_free_shash(shash_tfm);
return ret;
diff --git a/include/linux/nvme-auth.h b/include/linux/nvme-auth.h
index 60e069a6757f..fd43fa042c88 100644
--- a/include/linux/nvme-auth.h
+++ b/include/linux/nvme-auth.h
@@ -29,8 +29,8 @@ struct nvme_dhchap_key *nvme_auth_extract_key(unsigned char *secret,
u8 key_hash);
void nvme_auth_free_key(struct nvme_dhchap_key *key);
struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash);
-struct nvme_dhchap_key *nvme_auth_transform_key(
- struct nvme_dhchap_key *key, char *nqn);
+int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
+ u8 **transformed_secret) ;
int nvme_auth_generate_key(u8 *secret, struct nvme_dhchap_key **ret_key);
int nvme_auth_augmented_challenge(u8 hmac_id, u8 *skey, size_t skey_len,
u8 *challenge, u8 *aug, size_t hlen);
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
2025-04-25 9:49 ` [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-05-07 7:28 ` Christoph Hellwig
2025-04-25 9:49 ` [PATCH 03/12] nvmet-auth: " Hannes Reinecke
` (11 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Use SHASH_DESC_ON_STACK to avoid explicit allocation.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/common/auth.c | 23 ++++++-----------------
1 file changed, 6 insertions(+), 17 deletions(-)
diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index d6dfc4ff39a2..918c92cbd8c5 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -242,7 +242,7 @@ int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
{
const char *hmac_name;
struct crypto_shash *key_tfm;
- struct shash_desc *shash;
+ SHASH_DESC_ON_STACK(shash, key_tfm);
u8 *transformed_data;
u8 *key_data;
size_t transformed_len;
@@ -287,39 +287,28 @@ int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
goto out_free_tfm;
}
- shash = kmalloc(sizeof(struct shash_desc) +
- crypto_shash_descsize(key_tfm),
- GFP_KERNEL);
- if (!shash) {
- ret = -ENOMEM;
- goto out_free_transformed_data;
- }
-
shash->tfm = key_tfm;
ret = crypto_shash_setkey(key_tfm, key->key, key->len);
if (ret < 0)
- goto out_free_shash;
+ goto out_free_transformed_data;
ret = crypto_shash_init(shash);
if (ret < 0)
- goto out_free_shash;
+ goto out_free_transformed_data;
ret = crypto_shash_update(shash, nqn, strlen(nqn));
if (ret < 0)
- goto out_free_shash;
+ goto out_free_transformed_data;
ret = crypto_shash_update(shash, "NVMe-over-Fabrics", 17);
if (ret < 0)
- goto out_free_shash;
+ goto out_free_transformed_data;
ret = crypto_shash_final(shash, transformed_data);
if (ret < 0)
- goto out_free_shash;
+ goto out_free_transformed_data;
- kfree(shash);
crypto_free_shash(key_tfm);
*transformed_secret = transformed_data;
return transformed_len;
-out_free_shash:
- kfree(shash);
out_free_transformed_data:
kfree(transformed_data);
out_free_tfm:
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 03/12] nvmet-auth: use SHASH_DESC_ON_STACK
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
2025-04-25 9:49 ` [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status Hannes Reinecke
2025-04-25 9:49 ` [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 04/12] nvme-auth: do not cache the transformed secret Hannes Reinecke
` (10 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Use SHASH_DESC_ON_STACK to avoid explicit allocation.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/target/auth.c | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 46a25b76544d..bb2b7bda308b 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -290,7 +290,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
unsigned int shash_len)
{
struct crypto_shash *shash_tfm;
- struct shash_desc *shash;
+ SHASH_DESC_ON_STACK(shash, shash_tfm);
struct nvmet_ctrl *ctrl = req->sq->ctrl;
const char *hash_name;
u8 *challenge = req->sq->dhchap_c1;
@@ -342,19 +342,13 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
req->sq->dhchap_c1,
challenge, shash_len);
if (ret)
- goto out_free_challenge;
+ goto out;
}
pr_debug("ctrl %d qid %d host response seq %u transaction %d\n",
ctrl->cntlid, req->sq->qid, req->sq->dhchap_s1,
req->sq->dhchap_tid);
- shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(shash_tfm),
- GFP_KERNEL);
- if (!shash) {
- ret = -ENOMEM;
- goto out_free_challenge;
- }
shash->tfm = shash_tfm;
ret = crypto_shash_init(shash);
if (ret)
@@ -389,8 +383,6 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
goto out;
ret = crypto_shash_final(shash, response);
out:
- kfree(shash);
-out_free_challenge:
if (challenge != req->sq->dhchap_c1)
kfree(challenge);
out_free_response:
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 04/12] nvme-auth: do not cache the transformed secret
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (2 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 03/12] nvmet-auth: " Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-05-07 7:25 ` Christoph Hellwig
2025-04-25 9:49 ` [PATCH 05/12] nvme-keyring: add 'dhchap' key type Hannes Reinecke
` (9 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Only saving so much, and doesn't bring much benefit.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/host/auth.c | 29 +++++++++++------------------
1 file changed, 11 insertions(+), 18 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 4b6dc1dd5f66..4e30a491e677 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -24,8 +24,6 @@ struct nvme_dhchap_queue_context {
struct nvme_ctrl *ctrl;
struct crypto_shash *shash_tfm;
struct crypto_kpp *dh_tfm;
- u8 *transformed_secret;
- size_t transformed_len;
void *buf;
int qid;
int error;
@@ -431,28 +429,25 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl,
struct nvme_dhchap_queue_context *chap)
{
SHASH_DESC_ON_STACK(shash, chap->shash_tfm);
+ u8 *transformed_secret;
+ size_t transformed_len;
u8 buf[4], *challenge = chap->c1;
int ret;
dev_dbg(ctrl->device, "%s: qid %d host response seq %u transaction %d\n",
__func__, chap->qid, chap->s1, chap->transaction);
- if (!chap->transformed_secret) {
- ret = nvme_auth_transform_key(ctrl->host_key,
- ctrl->opts->host->nqn,
- &chap->transformed_secret);
- if (ret < 0)
- return ret;
- chap->transformed_len = ret;
- } else {
- dev_dbg(ctrl->device, "%s: qid %d re-using host response\n",
- __func__, chap->qid);
- }
+ ret = nvme_auth_transform_key(ctrl->host_key,
+ ctrl->opts->host->nqn,
+ &transformed_secret);
+ if (ret < 0)
+ return ret;
+ transformed_len = ret;
ret = crypto_shash_setkey(chap->shash_tfm,
- chap->transformed_secret, chap->transformed_len);
+ transformed_secret, transformed_len);
if (ret) {
- dev_warn(ctrl->device, "qid %d: failed to set key, error %d\n",
+ dev_warn(ctrl->device, "qid %d: failed to set host key, error %d\n",
chap->qid, ret);
goto out;
}
@@ -509,6 +504,7 @@ static int nvme_auth_dhchap_setup_host_response(struct nvme_ctrl *ctrl,
out:
if (challenge != chap->c1)
kfree(challenge);
+ kfree(transformed_secret);
return ret;
}
@@ -657,9 +653,6 @@ static int nvme_auth_dhchap_exponential(struct nvme_ctrl *ctrl,
static void nvme_auth_reset_dhchap(struct nvme_dhchap_queue_context *chap)
{
- kfree(chap->transformed_secret);
- chap->transformed_secret = NULL;
- chap->transformed_len = 0;
kfree_sensitive(chap->host_key);
chap->host_key = NULL;
chap->host_key_len = 0;
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 05/12] nvme-keyring: add 'dhchap' key type
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (3 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 04/12] nvme-auth: do not cache the transformed secret Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 06/12] nvme-auth: switch to use 'struct key' Hannes Reinecke
` (8 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Add a 'dhchap' keytype to store DH-HMAC-CHAP secret keys.
Keys are stored with a 'user-type' compatible payload, such
that one can use 'user_read()' to access the raw contents
and the 'read()' callback to get the base64-encoded key
data in the DH-HMAC-CHAP secret representation.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/common/keyring.c | 266 ++++++++++++++++++++++++++++++++++
include/linux/nvme-keyring.h | 22 ++-
2 files changed, 287 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c
index 32d16c53133b..a58c93c6d495 100644
--- a/drivers/nvme/common/keyring.c
+++ b/drivers/nvme/common/keyring.c
@@ -4,6 +4,9 @@
*/
#include <linux/module.h>
+#include <linux/crc32.h>
+#include <linux/base64.h>
+#include <linux/unaligned.h>
#include <linux/seq_file.h>
#include <linux/key-type.h>
#include <keys/user-type.h>
@@ -252,6 +255,262 @@ key_serial_t nvme_tls_psk_default(struct key *keyring,
}
EXPORT_SYMBOL_GPL(nvme_tls_psk_default);
+static void nvme_dhchap_psk_describe(const struct key *key, struct seq_file *m)
+{
+ seq_puts(m, key->description);
+ seq_printf(m, ": %u", key->datalen);
+}
+
+static bool nvme_dhchap_psk_match(const struct key *key,
+ const struct key_match_data *match_data)
+{
+ const char *match_id;
+ size_t match_len;
+
+ if (!key->description) {
+ pr_debug("%s: no key description\n", __func__);
+ return false;
+ }
+ if (!match_data->raw_data) {
+ pr_debug("%s: no match data\n", __func__);
+ return false;
+ }
+ match_id = match_data->raw_data;
+ match_len = strlen(match_id);
+ pr_debug("%s: match '%s' '%s' len %zd\n",
+ __func__, match_id, key->description, match_len);
+
+ return !memcmp(key->description, match_id, match_len);
+}
+
+static int nvme_dhchap_psk_match_preparse(struct key_match_data *match_data)
+{
+ match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE;
+ match_data->cmp = nvme_dhchap_psk_match;
+ return 0;
+}
+
+/**
+ * nvme_dhchap_psk_preparse - prepare DH-HMAC-CHAP key data
+ * @prep: preparsed payload of the key data
+ *
+ * Decode the DH-HMAC-CHAP key data passed in in @prep and
+ * store the resulting binary data. The binary data includes
+ * space for the CRC, the version, and the hmac identifier,
+ * but the data length is just the key data without the CRC.
+ * This allows the user to read the key data via the
+ * 'user_read()' function, but also to export the full
+ * key data including CRC via the 'read' callback from the key type.
+ */
+static int nvme_dhchap_psk_preparse(struct key_preparsed_payload *prep)
+{
+ struct user_key_payload *upayload;
+ size_t datalen = prep->datalen, keylen;
+ int ret;
+ u32 crc;
+ u8 version, hmac;
+
+ if (!prep->data) {
+ pr_debug("%s: Empty data", __func__);
+ prep->payload.data[0] = NULL;
+ prep->quotalen = 0;
+ return -EINVAL;
+ }
+
+ if (sscanf(prep->data, "DHHC-%01hhu:%02hhu:%*s", &version, &hmac) != 2) {
+ pr_debug("%s: invalid key data '%s'\n", __func__,
+ (char *)prep->data);
+ prep->payload.data[0] = NULL;
+ prep->quotalen = 0;
+ return -EINVAL;
+ }
+
+ /* skip header and final ':' character */
+ datalen -= 11;
+
+ /* keylen is the key length, 4 bytes CRC, 1 byte version, and 1 byte HMAC identifier */
+ switch (datalen) {
+ case 48:
+ keylen = 38;
+ break;
+ case 72:
+ keylen = 54;
+ break;
+ case 92:
+ keylen = 70;
+ break;
+ default:
+ pr_debug("%s: Invalid data length %lu\n", __func__, datalen);
+ prep->payload.data[0] = NULL;
+ prep->quotalen = 0;
+ return -EINVAL;
+ }
+
+ upayload = kzalloc(sizeof(*upayload) + keylen, GFP_KERNEL);
+ if (!upayload) {
+ prep->payload.data[0] = NULL;
+ prep->quotalen = 0;
+ return -ENOMEM;
+ }
+
+ /* decode the data */
+ prep->quotalen = keylen;
+ prep->payload.data[0] = upayload;
+ ret = base64_decode(prep->data + 10, datalen, upayload->data);
+ if (ret < 0) {
+ pr_debug("%s: Failed to decode key %s\n",
+ __func__, (char *)prep->data + 10);
+ return ret;
+ }
+ ret -= 4;
+ crc = ~crc32(~0, upayload->data, ret);
+ if (get_unaligned_le32(upayload->data + ret) != crc) {
+ pr_debug("%s: CRC mismatch for key\n", __func__);
+ /* CRC mismatch */
+ return -EKEYREJECTED;
+ }
+ upayload->data[ret + 4] = version;
+ upayload->data[ret + 5] = hmac;
+ upayload->datalen = ret;
+ return 0;
+}
+
+static long nvme_dhchap_psk_read(const struct key *key, char *buffer, size_t buflen)
+{
+ const struct user_key_payload *upayload;
+ size_t datalen, keylen;
+ u8 version, hmac;
+ long ret;
+
+ upayload = user_key_payload_locked(key);
+ switch (upayload->datalen) {
+ case 32:
+ keylen = 59;
+ break;
+ case 48:
+ keylen = 83;
+ break;
+ case 64:
+ keylen = 103;
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ if (!buffer || buflen == 0)
+ return keylen;
+
+ if (buflen < keylen)
+ return -EINVAL;
+
+ memset(buffer, 0, buflen);
+ version = upayload->data[upayload->datalen + 4];
+ hmac = upayload->data[upayload->datalen + 5];
+ ret = sprintf(buffer, "DHHC-%01hhu:%02hhu:", version, hmac);
+ if (ret < 0)
+ return -ENOKEY;
+ /* Include the trailing CRC */
+ datalen = upayload->datalen + 4;
+ ret += base64_encode(upayload->data, datalen, buffer + ret);
+ buffer[ret] = ':';
+ ret++;
+ return ret;
+}
+
+static struct key_type nvme_dhchap_psk_key_type = {
+ .name = "dhchap",
+ .flags = KEY_TYPE_NET_DOMAIN,
+ .preparse = nvme_dhchap_psk_preparse,
+ .free_preparse = user_free_preparse,
+ .match_preparse = nvme_dhchap_psk_match_preparse,
+ .instantiate = generic_key_instantiate,
+ .revoke = user_revoke,
+ .destroy = user_destroy,
+ .describe = nvme_dhchap_psk_describe,
+ .read = nvme_dhchap_psk_read,
+};
+
+struct key *nvme_dhchap_psk_refresh(struct key *keyring,
+ const u8 *data, size_t data_len)
+{
+ key_perm_t keyperm =
+ KEY_POS_SEARCH | KEY_POS_VIEW | KEY_POS_READ |
+ KEY_POS_WRITE | KEY_POS_LINK | KEY_POS_SETATTR |
+ KEY_USR_SEARCH | KEY_USR_VIEW | KEY_USR_READ;
+ char *identity;
+ key_ref_t keyref;
+ key_serial_t keyring_id;
+ struct key *key;
+ uuid_t key_uuid;
+
+ if (data == NULL || !data_len)
+ return ERR_PTR(-EINVAL);
+
+ generate_random_uuid(key_uuid.b);
+ identity = kasprintf(GFP_KERNEL, "%pU", &key_uuid);
+ if (!identity)
+ return ERR_PTR(-ENOMEM);
+ if (!keyring)
+ keyring = nvme_keyring;
+ keyring_id = key_serial(keyring);
+
+ pr_debug("keyring %x generate dhchap psk '%s'\n",
+ keyring_id, identity);
+ keyref = key_create(make_key_ref(keyring, true),
+ "dhchap", identity, data, data_len,
+ keyperm, KEY_ALLOC_NOT_IN_QUOTA |
+ KEY_ALLOC_BUILT_IN |
+ KEY_ALLOC_BYPASS_RESTRICTION);
+ if (IS_ERR(keyref)) {
+ pr_warn("refresh dhchap psk '%s' failed, error %ld\n",
+ identity, PTR_ERR(keyref));
+ kfree(identity);
+ return ERR_PTR(-ENOKEY);
+ }
+ key = key_ref_to_ptr(keyref);
+ pr_debug("generated dhchap psk %08x\n", key_serial(key));
+ kfree(identity);
+ return key;
+}
+EXPORT_SYMBOL_GPL(nvme_dhchap_psk_refresh);
+
+struct key *nvme_dhchap_psk_lookup(struct key *keyring, const char *identity)
+{
+ key_ref_t keyref;
+ key_serial_t keyring_id;
+
+ if (!keyring)
+ keyring = nvme_keyring;
+ keyring_id = key_serial(keyring);
+ pr_debug("keyring %x lookup dhchap psk '%s'\n",
+ keyring_id, identity);
+
+ keyref = keyring_search(make_key_ref(keyring, true),
+ &nvme_dhchap_psk_key_type,
+ identity, false);
+ if (IS_ERR(keyref)) {
+ pr_debug("lookup dhchap psk '%s' failed, error %ld\n",
+ identity, PTR_ERR(keyref));
+ return ERR_PTR(-ENOKEY);
+ }
+
+ return key_ref_to_ptr(keyref);
+}
+EXPORT_SYMBOL_GPL(nvme_dhchap_psk_lookup);
+
+u8 nvme_dhchap_psk_hash(struct key *key)
+{
+ const struct user_key_payload *upayload;
+ u8 hmac;
+
+ if (!key)
+ return 0;
+ upayload = user_key_payload_locked(key);
+ hmac = upayload->data[upayload->datalen + 5];
+ return hmac;
+}
+EXPORT_SYMBOL_GPL(nvme_dhchap_psk_hash);
+
static int __init nvme_keyring_init(void)
{
int err;
@@ -270,11 +529,18 @@ static int __init nvme_keyring_init(void)
key_put(nvme_keyring);
return err;
}
+ err = register_key_type(&nvme_dhchap_psk_key_type);
+ if (err) {
+ unregister_key_type(&nvme_tls_psk_key_type);
+ key_put(nvme_keyring);
+ return err;
+ }
return 0;
}
static void __exit nvme_keyring_exit(void)
{
+ unregister_key_type(&nvme_dhchap_psk_key_type);
unregister_key_type(&nvme_tls_psk_key_type);
key_revoke(nvme_keyring);
key_put(nvme_keyring);
diff --git a/include/linux/nvme-keyring.h b/include/linux/nvme-keyring.h
index ab8971afa973..d8baa71f061d 100644
--- a/include/linux/nvme-keyring.h
+++ b/include/linux/nvme-keyring.h
@@ -18,9 +18,14 @@ key_serial_t nvme_tls_psk_default(struct key *keyring,
key_serial_t nvme_keyring_id(void);
struct key *nvme_tls_key_lookup(key_serial_t key_id);
+
+struct key *nvme_dhchap_psk_refresh(struct key *keyring,
+ const u8 *data, size_t data_len);
+struct key *nvme_dhchap_psk_lookup(struct key *keyring, const char *identity);
+u8 nvme_dhchap_psk_hash(struct key *key);
+
#else
static inline struct key *nvme_tls_psk_refresh(struct key *keyring,
- const char *hostnqn, char *subnqn, u8 hmac_id,
u8 *data, size_t data_len, const char *digest)
{
return ERR_PTR(-ENOTSUPP);
@@ -38,5 +43,20 @@ static inline struct key *nvme_tls_key_lookup(key_serial_t key_id)
{
return ERR_PTR(-ENOTSUPP);
}
+static inline struct key *nvme_dhchap_psk_refresh(struct key *keyring,
+ const char *hostnqn, const char *subnqn,
+ u8 *data, size_t data_len)
+{
+ return ERR_PTR(-ENOTSUPP);
+}
+static inline struct key *nvme_dhchap_psk_lookup(struct key *keyring,
+ const char *hostnqn, const char *subnqn, u8 hmac);
+{
+ return ERR_PTR(-ENOTSUPP);
+}
+u8 nvme_dhchap_psk_hash(struct key *key)
+{
+ return 0;
+}
#endif /* !CONFIG_NVME_KEYRING */
#endif /* _NVME_KEYRING_H */
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 06/12] nvme-auth: switch to use 'struct key'
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (4 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 05/12] nvme-keyring: add 'dhchap' key type Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions Hannes Reinecke
` (7 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Use the new key type 'dhchap' to store the DH-HMAC-CHAP keys and modify
handling function to use 'struct key'.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/common/Kconfig | 1 +
drivers/nvme/common/auth.c | 141 ++++++++++++++----------------------
drivers/nvme/host/Kconfig | 1 -
drivers/nvme/host/auth.c | 28 ++++---
drivers/nvme/host/nvme.h | 4 +-
drivers/nvme/host/sysfs.c | 25 +++----
drivers/nvme/target/Kconfig | 1 -
drivers/nvme/target/auth.c | 40 +++++-----
drivers/nvme/target/nvmet.h | 4 +-
include/linux/nvme-auth.h | 8 +-
10 files changed, 113 insertions(+), 140 deletions(-)
diff --git a/drivers/nvme/common/Kconfig b/drivers/nvme/common/Kconfig
index da963e4f3f1f..8a5521c038c5 100644
--- a/drivers/nvme/common/Kconfig
+++ b/drivers/nvme/common/Kconfig
@@ -13,3 +13,4 @@ config NVME_AUTH
select CRYPTO_DH
select CRYPTO_DH_RFC7919_GROUPS
select CRYPTO_HKDF
+ select NVME_KEYRING
diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index 918c92cbd8c5..74763de526c3 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -14,6 +14,8 @@
#include <crypto/hkdf.h>
#include <linux/nvme.h>
#include <linux/nvme-auth.h>
+#include <linux/nvme-keyring.h>
+#include <keys/user-type.h>
#define HKDF_MAX_HASHLEN 64
@@ -161,58 +163,16 @@ u32 nvme_auth_key_struct_size(u32 key_len)
}
EXPORT_SYMBOL_GPL(nvme_auth_key_struct_size);
-struct nvme_dhchap_key *nvme_auth_extract_key(unsigned char *secret,
- u8 key_hash)
+struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret,
+ size_t secret_len)
{
- struct nvme_dhchap_key *key;
- unsigned char *p;
- u32 crc;
- int ret, key_len;
- size_t allocated_len = strlen(secret);
-
- /* Secret might be affixed with a ':' */
- p = strrchr(secret, ':');
- if (p)
- allocated_len = p - secret;
- key = nvme_auth_alloc_key(allocated_len, 0);
- if (!key)
- return ERR_PTR(-ENOMEM);
-
- key_len = base64_decode(secret, allocated_len, key->key);
- if (key_len < 0) {
- pr_debug("base64 key decoding error %d\n",
- key_len);
- ret = key_len;
- goto out_free_secret;
- }
-
- if (key_len != 36 && key_len != 52 &&
- key_len != 68) {
- pr_err("Invalid key len %d\n", key_len);
- ret = -EINVAL;
- goto out_free_secret;
- }
+ struct key *key;
- /* The last four bytes is the CRC in little-endian format */
- key_len -= 4;
- /*
- * The linux implementation doesn't do pre- and post-increments,
- * so we have to do it manually.
- */
- crc = ~crc32(~0, key->key, key_len);
-
- if (get_unaligned_le32(key->key + key_len) != crc) {
- pr_err("key crc mismatch (key %08x, crc %08x)\n",
- get_unaligned_le32(key->key + key_len), crc);
- ret = -EKEYREJECTED;
- goto out_free_secret;
- }
- key->len = key_len;
- key->hash = key_hash;
+ key = nvme_dhchap_psk_refresh(keyring, secret, secret_len);
+ if (!IS_ERR(key))
+ pr_debug("generated dhchap key %08x\n",
+ key_serial(key));
return key;
-out_free_secret:
- nvme_auth_free_key(key);
- return ERR_PTR(ret);
}
EXPORT_SYMBOL_GPL(nvme_auth_extract_key);
@@ -237,14 +197,15 @@ void nvme_auth_free_key(struct nvme_dhchap_key *key)
}
EXPORT_SYMBOL_GPL(nvme_auth_free_key);
-int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
+int nvme_auth_transform_key(struct key *key, char *nqn,
u8 **transformed_secret)
{
const char *hmac_name;
struct crypto_shash *key_tfm;
SHASH_DESC_ON_STACK(shash, key_tfm);
+ long key_len = 0;
u8 *transformed_data;
- u8 *key_data;
+ u8 *key_data, key_hash;
size_t transformed_len;
int ret;
@@ -252,17 +213,47 @@ int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
pr_warn("No key specified\n");
return -ENOKEY;
}
- key_data = kzalloc(key->len, GFP_KERNEL);
- if (!key_data)
+ down_read(&key->sem);
+ ret = key_validate(key);
+ if (ret) {
+ pr_warn("%s: key %08x invalidated\n",
+ __func__, key_serial(key));
+ up_read(&key->sem);
+ return ret;
+ }
+ key_len = user_read(key, NULL, 0);
+ if (key_len <= 0) {
+ pr_warn("failed to get length from key %08x: error %ld\n",
+ key_serial(key), key_len);
+ up_read(&key->sem);
+ return key_len;
+ }
+ key_data = kzalloc(key_len, GFP_KERNEL);
+ if (!key_data) {
+ up_read(&key->sem);
return -ENOMEM;
- memcpy(key_data, key->key, key->len);
- if (key->hash == 0) {
+ }
+
+ ret = user_read(key, key_data, key_len);
+ key_hash = nvme_dhchap_psk_hash(key);
+ up_read(&key->sem);
+ if (ret != key_len) {
+ if (ret < 0) {
+ pr_warn("failed to read data from key %08x: error %d\n",
+ key_serial(key), ret);
+ } else {
+ pr_warn("only read %d of %ld bytes from key %08x\n",
+ ret, key_len, key_serial(key));
+ }
+ goto out_free_data;
+ }
+ if (key_hash == 0) {
*transformed_secret = key_data;
- return key->len;
+ return key_len;
}
- hmac_name = nvme_auth_hmac_name(key->hash);
+ hmac_name = nvme_auth_hmac_name(key_hash);
if (!hmac_name) {
- pr_warn("Invalid key hash id %d\n", key->hash);
+ pr_warn("Invalid key hash id %d\n", key_hash);
ret = -EINVAL;
goto out_free_data;
}
@@ -274,9 +265,9 @@ int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
}
transformed_len = crypto_shash_digestsize(key_tfm);
- if (transformed_len != key->len) {
+ if (transformed_len != key_len) {
pr_warn("incompatible digest size %ld for key (hash %s, len %ld)\n",
- transformed_len, hmac_name, key->len);
+ transformed_len, hmac_name, key_len);
ret = -EINVAL;
goto out_free_tfm;
}
@@ -288,7 +279,7 @@ int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
}
shash->tfm = key_tfm;
- ret = crypto_shash_setkey(key_tfm, key->key, key->len);
+ ret = crypto_shash_setkey(key_tfm, key_data, key_len);
if (ret < 0)
goto out_free_transformed_data;
ret = crypto_shash_init(shash);
@@ -304,8 +295,9 @@ int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
if (ret < 0)
goto out_free_transformed_data;
- crypto_free_shash(key_tfm);
*transformed_secret = transformed_data;
+ crypto_free_shash(key_tfm);
+ kfree(key_data);
return transformed_len;
@@ -454,31 +446,6 @@ int nvme_auth_gen_shared_secret(struct crypto_kpp *dh_tfm,
}
EXPORT_SYMBOL_GPL(nvme_auth_gen_shared_secret);
-int nvme_auth_generate_key(u8 *secret, struct nvme_dhchap_key **ret_key)
-{
- struct nvme_dhchap_key *key;
- u8 key_hash;
-
- if (!secret) {
- *ret_key = NULL;
- return 0;
- }
-
- if (sscanf(secret, "DHHC-1:%hhd:%*s:", &key_hash) != 1)
- return -EINVAL;
-
- /* Pass in the secret without the 'DHHC-1:XX:' prefix */
- key = nvme_auth_extract_key(secret + 10, key_hash);
- if (IS_ERR(key)) {
- *ret_key = NULL;
- return PTR_ERR(key);
- }
-
- *ret_key = key;
- return 0;
-}
-EXPORT_SYMBOL_GPL(nvme_auth_generate_key);
-
/**
* nvme_auth_generate_psk - Generate a PSK for TLS
* @hmac_id: Hash function identifier
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index d47dfa80fb95..e7fb34fdc28b 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -114,7 +114,6 @@ config NVME_HOST_AUTH
bool "NVMe over Fabrics In-Band Authentication in host side"
depends on NVME_CORE
select NVME_AUTH
- select NVME_KEYRING
help
This provides support for NVMe over Fabrics In-Band Authentication in
host side.
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 4e30a491e677..f04bc5d807d8 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -1048,14 +1048,22 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work);
if (!ctrl->opts)
return 0;
- ret = nvme_auth_generate_key(ctrl->opts->dhchap_secret,
- &ctrl->host_key);
- if (ret)
+ ctrl->host_key = nvme_auth_extract_key(ctrl->opts->keyring,
+ ctrl->opts->dhchap_secret,
+ strlen(ctrl->opts->dhchap_secret));
+ if (IS_ERR(ctrl->host_key)) {
+ ret = PTR_ERR(ctrl->host_key);
+ ctrl->host_key = NULL;
return ret;
- ret = nvme_auth_generate_key(ctrl->opts->dhchap_ctrl_secret,
- &ctrl->ctrl_key);
- if (ret)
+ }
+ ctrl->ctrl_key = nvme_auth_extract_key(ctrl->opts->keyring,
+ ctrl->opts->dhchap_ctrl_secret,
+ strlen(ctrl->opts->dhchap_ctrl_secret));
+ if (IS_ERR(ctrl->ctrl_key)) {
+ ret = PTR_ERR(ctrl->ctrl_key);
+ ctrl->ctrl_key = NULL;
goto err_free_dhchap_secret;
+ }
if (!ctrl->opts->dhchap_secret && !ctrl->opts->dhchap_ctrl_secret)
return 0;
@@ -1076,10 +1084,10 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
return 0;
err_free_dhchap_ctrl_secret:
- nvme_auth_free_key(ctrl->ctrl_key);
+ key_put(ctrl->ctrl_key);
ctrl->ctrl_key = NULL;
err_free_dhchap_secret:
- nvme_auth_free_key(ctrl->host_key);
+ key_put(ctrl->host_key);
ctrl->host_key = NULL;
return ret;
}
@@ -1101,11 +1109,11 @@ void nvme_auth_free(struct nvme_ctrl *ctrl)
kfree(ctrl->dhchap_ctxs);
}
if (ctrl->host_key) {
- nvme_auth_free_key(ctrl->host_key);
+ key_put(ctrl->host_key);
ctrl->host_key = NULL;
}
if (ctrl->ctrl_key) {
- nvme_auth_free_key(ctrl->ctrl_key);
+ key_put(ctrl->ctrl_key);
ctrl->ctrl_key = NULL;
}
}
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 51e078642127..89c84220e340 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -378,8 +378,8 @@ struct nvme_ctrl {
struct work_struct dhchap_auth_work;
struct mutex dhchap_auth_mutex;
struct nvme_dhchap_queue_context *dhchap_ctxs;
- struct nvme_dhchap_key *host_key;
- struct nvme_dhchap_key *ctrl_key;
+ struct key *host_key;
+ struct key *ctrl_key;
u16 transaction;
#endif
key_serial_t tls_pskid;
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 6d31226f7a4f..888f2d836704 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -589,8 +589,6 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
return -EINVAL;
if (count < 7)
return -EINVAL;
- if (memcmp(buf, "DHHC-1:", 7))
- return -EINVAL;
dhchap_secret = kzalloc(count + 1, GFP_KERNEL);
if (!dhchap_secret)
@@ -598,13 +596,12 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
memcpy(dhchap_secret, buf, count);
nvme_auth_stop(ctrl);
if (strcmp(dhchap_secret, opts->dhchap_secret)) {
- struct nvme_dhchap_key *key, *host_key;
- int ret;
+ struct key *key, *host_key;
- ret = nvme_auth_generate_key(dhchap_secret, &key);
- if (ret) {
+ key = nvme_auth_extract_key(opts->keyring, dhchap_secret, count);
+ if (IS_ERR(key)) {
kfree(dhchap_secret);
- return ret;
+ return PTR_ERR(key);
}
kfree(opts->dhchap_secret);
opts->dhchap_secret = dhchap_secret;
@@ -612,7 +609,7 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
mutex_lock(&ctrl->dhchap_auth_mutex);
ctrl->host_key = key;
mutex_unlock(&ctrl->dhchap_auth_mutex);
- nvme_auth_free_key(host_key);
+ key_put(host_key);
} else
kfree(dhchap_secret);
/* Start re-authentication */
@@ -656,13 +653,13 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
memcpy(dhchap_secret, buf, count);
nvme_auth_stop(ctrl);
if (strcmp(dhchap_secret, opts->dhchap_ctrl_secret)) {
- struct nvme_dhchap_key *key, *ctrl_key;
- int ret;
+ struct key *key, *ctrl_key;
- ret = nvme_auth_generate_key(dhchap_secret, &key);
- if (ret) {
+ key = nvme_auth_extract_key(opts->keyring,
+ dhchap_secret, count);
+ if (IS_ERR(key)) {
kfree(dhchap_secret);
- return ret;
+ return PTR_ERR(key);
}
kfree(opts->dhchap_ctrl_secret);
opts->dhchap_ctrl_secret = dhchap_secret;
@@ -670,7 +667,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
mutex_lock(&ctrl->dhchap_auth_mutex);
ctrl->ctrl_key = key;
mutex_unlock(&ctrl->dhchap_auth_mutex);
- nvme_auth_free_key(ctrl_key);
+ key_put(ctrl_key);
} else
kfree(dhchap_secret);
/* Start re-authentication */
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index fb7446d6d682..28b5229c48e2 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -5,7 +5,6 @@ config NVME_TARGET
depends on BLOCK
depends on CONFIGFS_FS
select NVME_KEYRING if NVME_TARGET_TCP_TLS
- select KEYS if NVME_TARGET_TCP_TLS
select SGL_ALLOC
help
This enabled target side support for the NVMe protocol, that is
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index bb2b7bda308b..8afe571ea0ce 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -145,6 +145,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq)
int ret = 0;
struct nvmet_host_link *p;
struct nvmet_host *host = NULL;
+ u8 host_hash, ctrl_hash;
down_read(&nvmet_config_sem);
if (nvmet_is_disc_subsys(ctrl->subsys))
@@ -190,42 +191,43 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq)
ctrl->shash_id = host->dhchap_hash_id;
}
- /* Skip the 'DHHC-1:XX:' prefix */
- nvme_auth_free_key(ctrl->host_key);
- ctrl->host_key = nvme_auth_extract_key(host->dhchap_secret + 10,
- host->dhchap_key_hash);
+ key_put(ctrl->host_key);
+ ctrl->host_key = nvme_auth_extract_key(NULL, host->dhchap_secret,
+ strlen(host->dhchap_secret));
if (IS_ERR(ctrl->host_key)) {
ret = NVME_AUTH_DHCHAP_FAILURE_NOT_USABLE;
ctrl->host_key = NULL;
goto out_free_hash;
}
- pr_debug("%s: using hash %s key %*ph\n", __func__,
- ctrl->host_key->hash > 0 ?
- nvme_auth_hmac_name(ctrl->host_key->hash) : "none",
- (int)ctrl->host_key->len, ctrl->host_key->key);
+ host_hash = nvme_dhchap_psk_hash(ctrl->host_key);
+ pr_debug("%s: using hash %s key %u\n", __func__,
+ ctrl_hash > 0 ?
+ nvme_auth_hmac_name(ctrl_hash) : "none",
+ key_serial(ctrl->host_key));
- nvme_auth_free_key(ctrl->ctrl_key);
+ key_put(ctrl->ctrl_key);
if (!host->dhchap_ctrl_secret) {
ctrl->ctrl_key = NULL;
goto out_unlock;
}
- ctrl->ctrl_key = nvme_auth_extract_key(host->dhchap_ctrl_secret + 10,
- host->dhchap_ctrl_key_hash);
+ ctrl->ctrl_key = nvme_auth_extract_key(NULL, host->dhchap_ctrl_secret,
+ strlen(host->dhchap_ctrl_secret));
if (IS_ERR(ctrl->ctrl_key)) {
ret = NVME_AUTH_DHCHAP_FAILURE_NOT_USABLE;
ctrl->ctrl_key = NULL;
goto out_free_hash;
}
- pr_debug("%s: using ctrl hash %s key %*ph\n", __func__,
- ctrl->ctrl_key->hash > 0 ?
- nvme_auth_hmac_name(ctrl->ctrl_key->hash) : "none",
- (int)ctrl->ctrl_key->len, ctrl->ctrl_key->key);
+ ctrl_hash = nvme_dhchap_psk_hash(ctrl->ctrl_key);
+ pr_debug("%s: using ctrl hash %s key %u\n", __func__,
+ ctrl_hash > 0 ?
+ nvme_auth_hmac_name(ctrl_hash) : "none",
+ key_serial(ctrl->ctrl_key));
out_free_hash:
if (ret) {
if (ctrl->host_key) {
- nvme_auth_free_key(ctrl->host_key);
+ key_put(ctrl->host_key);
ctrl->host_key = NULL;
}
ctrl->shash_id = 0;
@@ -263,11 +265,13 @@ void nvmet_destroy_auth(struct nvmet_ctrl *ctrl)
ctrl->dh_key = NULL;
if (ctrl->host_key) {
- nvme_auth_free_key(ctrl->host_key);
+ key_revoke(ctrl->host_key);
+ key_put(ctrl->host_key);
ctrl->host_key = NULL;
}
if (ctrl->ctrl_key) {
- nvme_auth_free_key(ctrl->ctrl_key);
+ key_revoke(ctrl->ctrl_key);
+ key_put(ctrl->ctrl_key);
ctrl->ctrl_key = NULL;
}
#ifdef CONFIG_NVME_TARGET_TCP_TLS
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index b6db8b74dc4a..1aa9d2176f75 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -294,8 +294,8 @@ struct nvmet_ctrl {
bool pi_support;
bool concat;
#ifdef CONFIG_NVME_TARGET_AUTH
- struct nvme_dhchap_key *host_key;
- struct nvme_dhchap_key *ctrl_key;
+ struct key *host_key;
+ struct key *ctrl_key;
u8 shash_id;
struct crypto_kpp *dh_tfm;
u8 dh_gid;
diff --git a/include/linux/nvme-auth.h b/include/linux/nvme-auth.h
index fd43fa042c88..bb973b39fd79 100644
--- a/include/linux/nvme-auth.h
+++ b/include/linux/nvme-auth.h
@@ -25,13 +25,11 @@ size_t nvme_auth_hmac_hash_len(u8 hmac_id);
u8 nvme_auth_hmac_id(const char *hmac_name);
u32 nvme_auth_key_struct_size(u32 key_len);
-struct nvme_dhchap_key *nvme_auth_extract_key(unsigned char *secret,
- u8 key_hash);
+struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret, size_t secret_len);
void nvme_auth_free_key(struct nvme_dhchap_key *key);
struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash);
-int nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn,
- u8 **transformed_secret) ;
-int nvme_auth_generate_key(u8 *secret, struct nvme_dhchap_key **ret_key);
+int nvme_auth_transform_key(struct key *key, char *nqn,
+ u8 **transformed_secret);
int nvme_auth_augmented_challenge(u8 hmac_id, u8 *skey, size_t skey_len,
u8 *challenge, u8 *aug, size_t hlen);
int nvme_auth_gen_privkey(struct crypto_kpp *dh_tfm, u8 dh_gid);
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (5 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 06/12] nvme-auth: switch to use 'struct key' Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-05-07 7:26 ` Christoph Hellwig
2025-04-25 9:49 ` [PATCH 08/12] nvme: parse dhchap keys during option parsing Hannes Reinecke
` (6 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
Drop the hand-crafted nvme_dhchap_key structure and the now unused
functions.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/common/auth.c | 29 -----------------------------
include/linux/nvme-auth.h | 9 ---------
2 files changed, 38 deletions(-)
diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index 74763de526c3..8c2ccbfb9986 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -155,14 +155,6 @@ size_t nvme_auth_hmac_hash_len(u8 hmac_id)
}
EXPORT_SYMBOL_GPL(nvme_auth_hmac_hash_len);
-u32 nvme_auth_key_struct_size(u32 key_len)
-{
- struct nvme_dhchap_key key;
-
- return struct_size(&key, key, key_len);
-}
-EXPORT_SYMBOL_GPL(nvme_auth_key_struct_size);
-
struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret,
size_t secret_len)
{
@@ -176,27 +168,6 @@ struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret,
}
EXPORT_SYMBOL_GPL(nvme_auth_extract_key);
-struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash)
-{
- u32 num_bytes = nvme_auth_key_struct_size(len);
- struct nvme_dhchap_key *key = kzalloc(num_bytes, GFP_KERNEL);
-
- if (key) {
- key->len = len;
- key->hash = hash;
- }
- return key;
-}
-EXPORT_SYMBOL_GPL(nvme_auth_alloc_key);
-
-void nvme_auth_free_key(struct nvme_dhchap_key *key)
-{
- if (!key)
- return;
- kfree_sensitive(key);
-}
-EXPORT_SYMBOL_GPL(nvme_auth_free_key);
-
int nvme_auth_transform_key(struct key *key, char *nqn,
u8 **transformed_secret)
{
diff --git a/include/linux/nvme-auth.h b/include/linux/nvme-auth.h
index bb973b39fd79..4e53ef96eea7 100644
--- a/include/linux/nvme-auth.h
+++ b/include/linux/nvme-auth.h
@@ -8,12 +8,6 @@
#include <crypto/kpp.h>
-struct nvme_dhchap_key {
- size_t len;
- u8 hash;
- u8 key[];
-};
-
u32 nvme_auth_get_seqnum(void);
const char *nvme_auth_dhgroup_name(u8 dhgroup_id);
const char *nvme_auth_dhgroup_kpp(u8 dhgroup_id);
@@ -24,10 +18,7 @@ const char *nvme_auth_digest_name(u8 hmac_id);
size_t nvme_auth_hmac_hash_len(u8 hmac_id);
u8 nvme_auth_hmac_id(const char *hmac_name);
-u32 nvme_auth_key_struct_size(u32 key_len);
struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret, size_t secret_len);
-void nvme_auth_free_key(struct nvme_dhchap_key *key);
-struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash);
int nvme_auth_transform_key(struct key *key, char *nqn,
u8 **transformed_secret);
int nvme_auth_augmented_challenge(u8 hmac_id, u8 *skey, size_t skey_len,
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 08/12] nvme: parse dhchap keys during option parsing
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (6 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 09/12] nvmet-auth: parse dhchap key from configfs attribute Hannes Reinecke
` (5 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
We really should parse the dhchap keys during option parsing to avoid
having to pass around the plain dhchap secret. During options parsing
we will create a 'dhchap' key with a random UUID as description, and
store the key serial in the 'opts' structure.
This simplifies key handling as on every access the key needs to be
looked up and checked for validity before accessing the key data.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/host/auth.c | 113 ++++++++++++++++------
drivers/nvme/host/fabrics.c | 82 +++++++++++-----
drivers/nvme/host/fabrics.h | 8 +-
drivers/nvme/host/sysfs.c | 185 ++++++++++++++++++++++++++----------
4 files changed, 278 insertions(+), 110 deletions(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index f04bc5d807d8..d15ab5e98fe1 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -527,7 +527,7 @@ static int nvme_auth_dhchap_setup_ctrl_response(struct nvme_ctrl *ctrl,
ret = crypto_shash_setkey(chap->shash_tfm,
transformed_secret, transformed_len);
if (ret) {
- dev_warn(ctrl->device, "qid %d: failed to set key, error %d\n",
+ dev_warn(ctrl->device, "qid %d: failed to set ctrl key, error %d\n",
chap->qid, ret);
goto out;
}
@@ -959,11 +959,6 @@ int nvme_auth_negotiate(struct nvme_ctrl *ctrl, int qid)
return -ENOKEY;
}
- if (ctrl->opts->dhchap_ctrl_secret && !ctrl->ctrl_key) {
- dev_warn(ctrl->device, "qid %d: invalid ctrl key\n", qid);
- return -ENOKEY;
- }
-
chap = &ctrl->dhchap_ctxs[qid];
cancel_work_sync(&chap->auth_work);
queue_work(nvme_auth_wq, &chap->auth_work);
@@ -1039,6 +1034,26 @@ static void nvme_ctrl_auth_work(struct work_struct *work)
}
}
+static void nvme_auth_clear_key(struct nvme_ctrl *ctrl, bool is_ctrl)
+{
+ struct key *key;
+
+ if (is_ctrl) {
+ key = ctrl->ctrl_key;
+ ctrl->ctrl_key = NULL;
+ } else {
+ key = ctrl->host_key;
+ ctrl->host_key = NULL;
+ }
+ if (key) {
+ dev_dbg(ctrl->device, "%s: revoke%s key %08x\n",
+ __func__, is_ctrl ? " ctrl" : "",
+ key_serial(key));
+ key_revoke(key);
+ key_put(key);
+ }
+}
+
int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
{
struct nvme_dhchap_queue_context *chap;
@@ -1048,31 +1063,70 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
INIT_WORK(&ctrl->dhchap_auth_work, nvme_ctrl_auth_work);
if (!ctrl->opts)
return 0;
- ctrl->host_key = nvme_auth_extract_key(ctrl->opts->keyring,
- ctrl->opts->dhchap_secret,
- strlen(ctrl->opts->dhchap_secret));
- if (IS_ERR(ctrl->host_key)) {
- ret = PTR_ERR(ctrl->host_key);
- ctrl->host_key = NULL;
- return ret;
+ if (!ctrl->opts->dhchap_key) {
+ nvme_auth_clear_key(ctrl, false);
+ nvme_auth_clear_key(ctrl, true);
+ return 0;
}
- ctrl->ctrl_key = nvme_auth_extract_key(ctrl->opts->keyring,
- ctrl->opts->dhchap_ctrl_secret,
- strlen(ctrl->opts->dhchap_ctrl_secret));
- if (IS_ERR(ctrl->ctrl_key)) {
- ret = PTR_ERR(ctrl->ctrl_key);
- ctrl->ctrl_key = NULL;
- goto err_free_dhchap_secret;
+
+ if (ctrl->host_key)
+ nvme_auth_clear_key(ctrl, false);
+
+ ctrl->host_key = key_get(ctrl->opts->dhchap_key);
+ if (!ctrl->host_key) {
+ dev_warn(ctrl->device,
+ "dhchap key %08x not present\n",
+ key_serial(ctrl->opts->dhchap_key));
+ return -ENOKEY;
+ }
+ down_read(&ctrl->host_key->sem);
+ ret = key_validate(ctrl->host_key);
+ up_read(&ctrl->host_key->sem);
+ if (ret) {
+ dev_warn(ctrl->device,
+ "dhchap key %08x invalidated\n",
+ key_serial(ctrl->host_key));
+ key_put(ctrl->host_key);
+ ctrl->host_key = NULL;
+ return -ENOKEY;
}
+ dev_dbg(ctrl->device,
+ "%s: using dhchap key %08x\n",
+ __func__, key_serial(ctrl->host_key));
- if (!ctrl->opts->dhchap_secret && !ctrl->opts->dhchap_ctrl_secret)
- return 0;
+ if (ctrl->ctrl_key)
+ nvme_auth_clear_key(ctrl, true);
+
+ if (ctrl->opts->dhchap_ctrl_key) {
+ ctrl->ctrl_key = key_get(ctrl->opts->dhchap_ctrl_key);
+ if (!ctrl->ctrl_key) {
+ dev_warn(ctrl->device,
+ "dhchap ctrl key %08x not present\n",
+ key_serial(ctrl->opts->dhchap_ctrl_key));
+ return -ENOKEY;
+ }
+ down_read(&ctrl->ctrl_key->sem);
+ ret = key_validate(ctrl->ctrl_key);
+ up_read(&ctrl->ctrl_key->sem);
+ if (ret) {
+ dev_warn(ctrl->device,
+ "dhchap ctrl key %08x invalidated\n",
+ key_serial(ctrl->ctrl_key));
+ key_put(ctrl->ctrl_key);
+ ctrl->ctrl_key = NULL;
+ return -EKEYREVOKED;
+ }
+ dev_dbg(ctrl->device,
+ "%s: using dhchap ctrl key %08x\n",
+ __func__, key_serial(ctrl->ctrl_key));
+ }
ctrl->dhchap_ctxs = kvcalloc(ctrl_max_dhchaps(ctrl),
sizeof(*chap), GFP_KERNEL);
if (!ctrl->dhchap_ctxs) {
- ret = -ENOMEM;
- goto err_free_dhchap_ctrl_secret;
+ nvme_auth_clear_key(ctrl, true);
+ nvme_auth_clear_key(ctrl, false);
+ return -ENOMEM;
}
for (i = 0; i < ctrl_max_dhchaps(ctrl); i++) {
@@ -1083,13 +1137,6 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
}
return 0;
-err_free_dhchap_ctrl_secret:
- key_put(ctrl->ctrl_key);
- ctrl->ctrl_key = NULL;
-err_free_dhchap_secret:
- key_put(ctrl->host_key);
- ctrl->host_key = NULL;
- return ret;
}
EXPORT_SYMBOL_GPL(nvme_auth_init_ctrl);
@@ -1109,10 +1156,14 @@ void nvme_auth_free(struct nvme_ctrl *ctrl)
kfree(ctrl->dhchap_ctxs);
}
if (ctrl->host_key) {
+ dev_dbg(ctrl->device, "%s: drop host key %08x\n",
+ __func__, key_serial(ctrl->host_key));
key_put(ctrl->host_key);
ctrl->host_key = NULL;
}
if (ctrl->ctrl_key) {
+ dev_dbg(ctrl->device, "%s: drop ctrl key %08x\n",
+ __func__, key_serial(ctrl->ctrl_key));
key_put(ctrl->ctrl_key);
ctrl->ctrl_key = NULL;
}
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 93e9041b9657..009a6cf8a86b 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -12,6 +12,7 @@
#include <linux/seq_file.h>
#include "nvme.h"
#include "fabrics.h"
+#include <linux/nvme-auth.h>
#include <linux/nvme-keyring.h>
static LIST_HEAD(nvmf_transports);
@@ -717,6 +718,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
{
substring_t args[MAX_OPT_ARGS];
char *options, *o, *p;
+ char *host_secret = NULL, *ctrl_secret = NULL;
int token, ret = 0;
size_t nqnlen = 0;
int ctrl_loss_tmo = NVMF_DEF_CTRL_LOSS_TMO, key_id;
@@ -738,6 +740,8 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
opts->tls_key = NULL;
opts->keyring = NULL;
opts->concat = false;
+ opts->dhchap_key = NULL;
+ opts->dhchap_ctrl_key = NULL;
options = o = kstrdup(buf, GFP_KERNEL);
if (!options)
@@ -1026,13 +1030,8 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
ret = -ENOMEM;
goto out;
}
- if (strlen(p) < 11 || strncmp(p, "DHHC-1:", 7)) {
- pr_err("Invalid DH-CHAP secret %s\n", p);
- ret = -EINVAL;
- goto out;
- }
- kfree(opts->dhchap_secret);
- opts->dhchap_secret = p;
+ kfree(host_secret);
+ host_secret = p;
break;
case NVMF_OPT_DHCHAP_CTRL_SECRET:
p = match_strdup(args);
@@ -1040,13 +1039,8 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
ret = -ENOMEM;
goto out;
}
- if (strlen(p) < 11 || strncmp(p, "DHHC-1:", 7)) {
- pr_err("Invalid DH-CHAP secret %s\n", p);
- ret = -EINVAL;
- goto out;
- }
- kfree(opts->dhchap_ctrl_secret);
- opts->dhchap_ctrl_secret = p;
+ kfree(ctrl_secret);
+ ctrl_secret = p;
break;
case NVMF_OPT_TLS:
if (!IS_ENABLED(CONFIG_NVME_TCP_TLS)) {
@@ -1090,6 +1084,41 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
pr_warn("failfast tmo (%d) larger than controller loss tmo (%d)\n",
opts->fast_io_fail_tmo, ctrl_loss_tmo);
}
+
+ opts->host = nvmf_host_add(hostnqn, &hostid);
+ if (IS_ERR(opts->host)) {
+ ret = PTR_ERR(opts->host);
+ opts->host = NULL;
+ goto out;
+ }
+
+ if (host_secret) {
+ pr_debug("lookup host identity '%s'\n", host_secret);
+ key = nvme_auth_extract_key(opts->keyring, host_secret,
+ strlen(host_secret));
+ if (IS_ERR(key)) {
+ ret = PTR_ERR(key);
+ goto out;
+ }
+ pr_debug("using dhchap key %08x\n", key_serial(key));
+ opts->dhchap_key = key;
+ }
+ if (ctrl_secret) {
+ if (!opts->dhchap_key) {
+ ret = -EINVAL;
+ goto out;
+ }
+ pr_debug("lookup ctrl identity '%s'\n", ctrl_secret);
+ key = nvme_auth_extract_key(opts->keyring, ctrl_secret,
+ strlen(ctrl_secret));
+ if (IS_ERR(key)) {
+ ret = PTR_ERR(key);
+ goto out;
+ }
+ pr_debug("using dhchap ctrl key %08x\n", key_serial(key));
+ opts->dhchap_ctrl_key = key;
+ }
+
if (opts->concat) {
if (opts->tls) {
pr_err("Secure concatenation over TLS is not supported\n");
@@ -1101,21 +1130,16 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
ret = -EINVAL;
goto out;
}
- if (!opts->dhchap_secret) {
+ if (!opts->dhchap_key) {
pr_err("Need to enable DH-CHAP for secure concatenation\n");
ret = -EINVAL;
goto out;
}
}
- opts->host = nvmf_host_add(hostnqn, &hostid);
- if (IS_ERR(opts->host)) {
- ret = PTR_ERR(opts->host);
- opts->host = NULL;
- goto out;
- }
-
out:
+ kfree(ctrl_secret);
+ kfree(host_secret);
kfree(options);
return ret;
}
@@ -1290,8 +1314,18 @@ void nvmf_free_options(struct nvmf_ctrl_options *opts)
kfree(opts->subsysnqn);
kfree(opts->host_traddr);
kfree(opts->host_iface);
- kfree(opts->dhchap_secret);
- kfree(opts->dhchap_ctrl_secret);
+ if (opts->dhchap_key) {
+ pr_debug("revoke dhchap key %08x\n",
+ key_serial(opts->dhchap_key));
+ key_revoke(opts->dhchap_key);
+ key_put(opts->dhchap_key);
+ }
+ if (opts->dhchap_ctrl_key) {
+ pr_debug("revoke dhchap ctrl key %08x\n",
+ key_serial(opts->dhchap_ctrl_key));
+ key_revoke(opts->dhchap_key);
+ key_put(opts->dhchap_ctrl_key);
+ }
kfree(opts);
}
EXPORT_SYMBOL_GPL(nvmf_free_options);
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 9cf5b020adba..95a3d8ce1201 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -96,8 +96,8 @@ enum {
* @discovery_nqn: indicates if the subsysnqn is the well-known discovery NQN.
* @kato: Keep-alive timeout.
* @host: Virtual NVMe host, contains the NQN and Host ID.
- * @dhchap_secret: DH-HMAC-CHAP secret
- * @dhchap_ctrl_secret: DH-HMAC-CHAP controller secret for bi-directional
+ * @dhchap_key: DH-HMAC-CHAP pre-shared key
+ * @dhchap_ctrl_key: DH-HMAC-CHAP controller pre-shared key for bi-directional
* authentication
* @keyring: Keyring to use for key lookups
* @tls_key: TLS key for encrypted connections (TCP)
@@ -127,8 +127,8 @@ struct nvmf_ctrl_options {
bool duplicate_connect;
unsigned int kato;
struct nvmf_host *host;
- char *dhchap_secret;
- char *dhchap_ctrl_secret;
+ struct key *dhchap_key;
+ struct key *dhchap_ctrl_key;
struct key *keyring;
struct key *tls_key;
bool tls;
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 888f2d836704..e7a635d6037e 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -6,6 +6,8 @@
*/
#include <linux/nvme-auth.h>
+#include <linux/nvme-keyring.h>
+#include <linux/key-type.h>
#include "nvme.h"
#include "fabrics.h"
@@ -571,11 +573,23 @@ static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
- struct nvmf_ctrl_options *opts = ctrl->opts;
+ struct key *key = ctrl->host_key;
+ ssize_t count;
- if (!opts->dhchap_secret)
+ if (!key)
return sysfs_emit(buf, "none\n");
- return sysfs_emit(buf, "%s\n", opts->dhchap_secret);
+ down_read(&key->sem);
+ if (key_validate(key))
+ count = sysfs_emit(buf, "<invalidated>\n");
+ else {
+ count = key->type->read(key, buf, PAGE_SIZE);
+ if (count > 0) {
+ buf[count] = '\n';
+ count++;
+ }
+ }
+ up_read(&key->sem);
+ return count;
}
static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
@@ -583,35 +597,47 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
struct nvmf_ctrl_options *opts = ctrl->opts;
+ struct key *key, *old_key;
char *dhchap_secret;
+ size_t len;
+ int ret;
- if (!ctrl->opts->dhchap_secret)
- return -EINVAL;
- if (count < 7)
+ if (!ctrl->host_key || !strlen(buf))
return -EINVAL;
- dhchap_secret = kzalloc(count + 1, GFP_KERNEL);
+ len = strcspn(buf, "\n");
+ dhchap_secret = kzalloc(len + 1, GFP_KERNEL);
if (!dhchap_secret)
return -ENOMEM;
- memcpy(dhchap_secret, buf, count);
+ memcpy(dhchap_secret, buf, len);
nvme_auth_stop(ctrl);
- if (strcmp(dhchap_secret, opts->dhchap_secret)) {
- struct key *key, *host_key;
-
- key = nvme_auth_extract_key(opts->keyring, dhchap_secret, count);
- if (IS_ERR(key)) {
- kfree(dhchap_secret);
- return PTR_ERR(key);
- }
- kfree(opts->dhchap_secret);
- opts->dhchap_secret = dhchap_secret;
- host_key = ctrl->host_key;
- mutex_lock(&ctrl->dhchap_auth_mutex);
- ctrl->host_key = key;
- mutex_unlock(&ctrl->dhchap_auth_mutex);
- key_put(host_key);
- } else
+ key = nvme_auth_extract_key(opts->keyring,
+ dhchap_secret, count);
+ if (IS_ERR(key)) {
kfree(dhchap_secret);
+ return PTR_ERR(key);
+ }
+ down_read(&key->sem);
+ ret = key_validate(key);
+ up_read(&key->sem);
+ if (ret) {
+ dev_warn(ctrl->dev, "key %08x invalidated\n", key_serial(key));
+ dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
+ key_revoke(key);
+ key_put(key);
+ kfree(dhchap_secret);
+ return ret;
+ }
+ mutex_lock(&ctrl->dhchap_auth_mutex);
+ old_key = ctrl->host_key;
+ dev_dbg(ctrl->dev, "revoke key %08x\n",
+ key_serial(old_key));
+ key_revoke(old_key);
+
+ ctrl->host_key = key;
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ key_put(old_key);
+ kfree(dhchap_secret);
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
queue_work(nvme_wq, &ctrl->dhchap_auth_work);
@@ -626,11 +652,23 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
- struct nvmf_ctrl_options *opts = ctrl->opts;
+ struct key *key = ctrl->ctrl_key;
+ size_t count;
- if (!opts->dhchap_ctrl_secret)
+ if (!key)
return sysfs_emit(buf, "none\n");
- return sysfs_emit(buf, "%s\n", opts->dhchap_ctrl_secret);
+ down_read(&key->sem);
+ if (key_validate(key))
+ count = sysfs_emit(buf, "<invalidated>");
+ else {
+ count = key->type->read(key, buf, PAGE_SIZE);
+ if (count > 0) {
+ buf[count] = '\n';
+ count++;
+ }
+ }
+ up_read(&key->sem);
+ return count;
}
static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
@@ -638,38 +676,46 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
struct nvmf_ctrl_options *opts = ctrl->opts;
+ struct key *key, *old_key;
char *dhchap_secret;
+ size_t len;
+ int ret;
- if (!ctrl->opts->dhchap_ctrl_secret)
- return -EINVAL;
- if (count < 7)
- return -EINVAL;
- if (memcmp(buf, "DHHC-1:", 7))
+ if (!ctrl->ctrl_key || !strlen(buf))
return -EINVAL;
- dhchap_secret = kzalloc(count + 1, GFP_KERNEL);
+ len = strcspn(buf, "\n");
+ dhchap_secret = kzalloc(len + 1, GFP_KERNEL);
if (!dhchap_secret)
return -ENOMEM;
- memcpy(dhchap_secret, buf, count);
+ memcpy(dhchap_secret, buf, len);
nvme_auth_stop(ctrl);
- if (strcmp(dhchap_secret, opts->dhchap_ctrl_secret)) {
- struct key *key, *ctrl_key;
-
- key = nvme_auth_extract_key(opts->keyring,
- dhchap_secret, count);
- if (IS_ERR(key)) {
- kfree(dhchap_secret);
- return PTR_ERR(key);
- }
- kfree(opts->dhchap_ctrl_secret);
- opts->dhchap_ctrl_secret = dhchap_secret;
- ctrl_key = ctrl->ctrl_key;
- mutex_lock(&ctrl->dhchap_auth_mutex);
- ctrl->ctrl_key = key;
- mutex_unlock(&ctrl->dhchap_auth_mutex);
- key_put(ctrl_key);
- } else
+ key = nvme_auth_extract_key(opts->keyring,
+ dhchap_secret, count);
+ if (IS_ERR(key)) {
kfree(dhchap_secret);
+ return PTR_ERR(key);
+ }
+ down_read(&key->sem);
+ ret = key_validate(key);
+ up_read(&key->sem);
+ if (ret) {
+ dev_warn(ctrl->dev, "key %08x invalidated\n", key_serial(key));
+ dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
+ key_revoke(key);
+ key_put(key);
+ kfree(dhchap_secret);
+ return ret;
+ }
+ mutex_lock(&ctrl->dhchap_auth_mutex);
+ old_key = ctrl->ctrl_key;
+ dev_dbg(ctrl->dev, "revoke key %08x\n",
+ key_serial(old_key));
+ key_revoke(old_key);
+ ctrl->ctrl_key = key;
+ mutex_unlock(&ctrl->dhchap_auth_mutex);
+ key_put(old_key);
+ kfree(dhchap_secret);
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
queue_work(nvme_wq, &ctrl->dhchap_auth_work);
@@ -679,6 +725,41 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
static DEVICE_ATTR(dhchap_ctrl_secret, S_IRUGO | S_IWUSR,
nvme_ctrl_dhchap_ctrl_secret_show, nvme_ctrl_dhchap_ctrl_secret_store);
+
+static ssize_t dhchap_key_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
+ struct key *key = ctrl->host_key;
+ size_t count;
+
+ if (!key)
+ return 0;
+ down_read(&key->sem);
+ if (key_validate(key))
+ count = sysfs_emit(buf, "<invalidated>\n");
+ else {
+ count = key->type->read(key, buf, PAGE_SIZE);
+ if (count > 0) {
+ buf[count] = '\n';
+ count++;
+ }
+ }
+ up_read(&key->sem);
+ return count;
+}
+static DEVICE_ATTR_RO(dhchap_key);
+
+static ssize_t dhchap_ctrl_key_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
+
+ if (!ctrl->ctrl_key)
+ return 0;
+ return sysfs_emit(buf, "%08x\n", key_serial(ctrl->ctrl_key));
+}
+static DEVICE_ATTR_RO(dhchap_ctrl_key);
#endif
static struct attribute *nvme_dev_attrs[] = {
@@ -707,6 +788,8 @@ static struct attribute *nvme_dev_attrs[] = {
#ifdef CONFIG_NVME_HOST_AUTH
&dev_attr_dhchap_secret.attr,
&dev_attr_dhchap_ctrl_secret.attr,
+ &dev_attr_dhchap_key.attr,
+ &dev_attr_dhchap_ctrl_key.attr,
#endif
&dev_attr_adm_passthru_err_log_enabled.attr,
NULL
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 09/12] nvmet-auth: parse dhchap key from configfs attribute
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (7 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 08/12] nvme: parse dhchap keys during option parsing Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 10/12] nvme: allow to pass in key serial number as dhchap secret Hannes Reinecke
` (4 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
When writing a new dhchap key to the 'dhchap_secret' attribute
we should be parsing it directly and only use the pointer to the
inserted key. This avoids having to pass around a pointer with the
actual data. There is only one snag with that; the dhchap controller
secret is stored under the host configfs directory, so we have no
indication as to which subsystem the dhchap secret matches.
So store it with the host NQN as subsystem NQN to indicate that
it's a controller secret applicable for any subsystem for this
host.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/target/auth.c | 176 +++++++++++++++++++++------------
drivers/nvme/target/configfs.c | 59 ++++++++---
drivers/nvme/target/nvmet.h | 7 +-
3 files changed, 159 insertions(+), 83 deletions(-)
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 8afe571ea0ce..59394587a875 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -20,54 +20,76 @@
#include "nvmet.h"
+void nvmet_auth_revoke_key(struct nvmet_host *host, bool set_ctrl)
+{
+ struct key *key = ERR_PTR(-ENOKEY);
+
+ if (set_ctrl) {
+ if (host->dhchap_ctrl_key) {
+ key = host->dhchap_ctrl_key;
+ host->dhchap_ctrl_key = NULL;
+ }
+ } else {
+ if (host->dhchap_key) {
+ key = host->dhchap_key;
+ host->dhchap_key = NULL;
+ }
+ }
+ if (!IS_ERR(key)) {
+ pr_debug("%s: revoke %s key %08x\n",
+ __func__, set_ctrl ? "ctrl" : "host",
+ key_serial(key));
+ key_revoke(key);
+ key_put(key);
+ }
+}
+
int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
bool set_ctrl)
{
unsigned char key_hash;
- char *dhchap_secret;
+ struct key *key;
+ size_t len;
if (!strlen(secret)) {
- if (set_ctrl) {
- kfree(host->dhchap_ctrl_secret);
- host->dhchap_ctrl_secret = NULL;
- host->dhchap_ctrl_key_hash = 0;
- } else {
- kfree(host->dhchap_secret);
- host->dhchap_secret = NULL;
- host->dhchap_key_hash = 0;
- }
+ nvmet_auth_revoke_key(host, set_ctrl);
return 0;
}
- if (sscanf(secret, "DHHC-1:%hhd:%*s", &key_hash) != 1)
- return -EINVAL;
- if (key_hash > 3) {
- pr_warn("Invalid DH-HMAC-CHAP hash id %d\n",
- key_hash);
- return -EINVAL;
+
+ len = strcspn(secret, "\n");
+ key = nvme_auth_extract_key(NULL, secret, len);
+ if (IS_ERR(key)) {
+ pr_debug("%s: invalid key specification\n", __func__);
+ return PTR_ERR(key);
+ }
+ down_read(&key->sem);
+ if (key_validate(key)) {
+ pr_warn("%s: key %08x invalidated\n",
+ __func__, key_serial(key));
+ up_read(&key->sem);
+ key_put(key);
+ return -EKEYREVOKED;
}
+
+ key_hash = nvme_dhchap_psk_hash(key);
if (key_hash > 0) {
/* Validate selected hash algorithm */
const char *hmac = nvme_auth_hmac_name(key_hash);
if (!crypto_has_shash(hmac, 0, 0)) {
pr_err("DH-HMAC-CHAP hash %s unsupported\n", hmac);
+ up_read(&key->sem);
+ key_put(key);
return -ENOTSUPP;
}
}
- dhchap_secret = kstrdup(secret, GFP_KERNEL);
- if (!dhchap_secret)
- return -ENOMEM;
- down_write(&nvmet_config_sem);
+ up_read(&key->sem);
+ nvmet_auth_revoke_key(host, set_ctrl);
if (set_ctrl) {
- kfree(host->dhchap_ctrl_secret);
- host->dhchap_ctrl_secret = strim(dhchap_secret);
- host->dhchap_ctrl_key_hash = key_hash;
+ host->dhchap_ctrl_key = key;
} else {
- kfree(host->dhchap_secret);
- host->dhchap_secret = strim(dhchap_secret);
- host->dhchap_key_hash = key_hash;
+ host->dhchap_key = key;
}
- up_write(&nvmet_config_sem);
return 0;
}
@@ -145,7 +167,8 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq)
int ret = 0;
struct nvmet_host_link *p;
struct nvmet_host *host = NULL;
- u8 host_hash, ctrl_hash;
+ struct key *key;
+ key_serial_t key_id;
down_read(&nvmet_config_sem);
if (nvmet_is_disc_subsys(ctrl->subsys))
@@ -179,7 +202,7 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq)
goto out_unlock;
}
- if (!host->dhchap_secret) {
+ if (!host->dhchap_key) {
pr_debug("No authentication provided\n");
goto out_unlock;
}
@@ -191,47 +214,68 @@ u8 nvmet_setup_auth(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq)
ctrl->shash_id = host->dhchap_hash_id;
}
- key_put(ctrl->host_key);
- ctrl->host_key = nvme_auth_extract_key(NULL, host->dhchap_secret,
- strlen(host->dhchap_secret));
- if (IS_ERR(ctrl->host_key)) {
- ret = NVME_AUTH_DHCHAP_FAILURE_NOT_USABLE;
- ctrl->host_key = NULL;
- goto out_free_hash;
+ key = key_get(host->dhchap_key);
+ if (!key) {
+ pr_warn("%s: host key %08x not found\n",
+ __func__, key_serial(host->dhchap_key));
+ goto out_unlock;
}
- host_hash = nvme_dhchap_psk_hash(ctrl->host_key);
- pr_debug("%s: using hash %s key %u\n", __func__,
- ctrl_hash > 0 ?
- nvme_auth_hmac_name(ctrl_hash) : "none",
- key_serial(ctrl->host_key));
-
- key_put(ctrl->ctrl_key);
- if (!host->dhchap_ctrl_secret) {
- ctrl->ctrl_key = NULL;
+ down_read(&key->sem);
+ ret = key_validate(key);
+ if (!ret) {
+ if (ctrl->host_key) {
+ pr_debug("%s: drop host key %08x\n",
+ __func__, key_serial(ctrl->host_key));
+ key_put(ctrl->host_key);
+ }
+ ctrl->host_key = key;
+ }
+ key_id = key_serial(key);
+ up_read(&key->sem);
+ if (ret) {
+ pr_debug("key id %08x invalidated\n", key_id);
+ key_put(key);
+ key = ERR_PTR(-EKEYREVOKED);
+ }
+ pr_debug("%s: using dhchap hash %s key %08x\n", __func__,
+ nvme_auth_hmac_name(ctrl->shash_id), key_id);
+
+ if (!host->dhchap_ctrl_key) {
+ if (ctrl->ctrl_key) {
+ pr_debug("%s: drop ctrl key %08x\n",
+ __func__, key_serial(ctrl->ctrl_key));
+ key_put(ctrl->ctrl_key);
+ ctrl->ctrl_key = NULL;
+ }
goto out_unlock;
}
- ctrl->ctrl_key = nvme_auth_extract_key(NULL, host->dhchap_ctrl_secret,
- strlen(host->dhchap_ctrl_secret));
- if (IS_ERR(ctrl->ctrl_key)) {
- ret = NVME_AUTH_DHCHAP_FAILURE_NOT_USABLE;
- ctrl->ctrl_key = NULL;
- goto out_free_hash;
+ key = key_get(host->dhchap_ctrl_key);
+ if (!key) {
+ pr_warn("%s: ctrl key %08x not found\n",
+ __func__, key_serial(host->dhchap_ctrl_key));
+ goto out_unlock;
}
- ctrl_hash = nvme_dhchap_psk_hash(ctrl->ctrl_key);
- pr_debug("%s: using ctrl hash %s key %u\n", __func__,
- ctrl_hash > 0 ?
- nvme_auth_hmac_name(ctrl_hash) : "none",
- key_serial(ctrl->ctrl_key));
-
-out_free_hash:
- if (ret) {
- if (ctrl->host_key) {
- key_put(ctrl->host_key);
- ctrl->host_key = NULL;
+ down_read(&key->sem);
+ ret = key_validate(key);
+ if (!ret) {
+ if (ctrl->ctrl_key) {
+ pr_debug("%s: drop ctrl key %08x\n",
+ __func__, key_serial(ctrl->ctrl_key));
+ key_put(ctrl->ctrl_key);
}
- ctrl->shash_id = 0;
+ ctrl->ctrl_key = key;
}
+ key_id = key_serial(key);
+ up_read(&key->sem);
+ if (ret) {
+ pr_debug("ctrl key id %08x invalidated\n", key_id);
+ key_put(key);
+ goto out_unlock;
+ }
+ pr_debug("%s: using dhchap ctrl hash %s key %08x\n", __func__,
+ nvme_auth_hmac_name(ctrl->shash_id), key_id);
+
out_unlock:
up_read(&nvmet_config_sem);
@@ -265,12 +309,14 @@ void nvmet_destroy_auth(struct nvmet_ctrl *ctrl)
ctrl->dh_key = NULL;
if (ctrl->host_key) {
- key_revoke(ctrl->host_key);
+ pr_debug("%s: drop host key %08x\n",
+ __func__, key_serial(ctrl->host_key));
key_put(ctrl->host_key);
ctrl->host_key = NULL;
}
if (ctrl->ctrl_key) {
- key_revoke(ctrl->ctrl_key);
+ pr_debug("%s: drop ctrl key %08x\n",
+ __func__, key_serial(ctrl->ctrl_key));
key_put(ctrl->ctrl_key);
ctrl->ctrl_key = NULL;
}
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index e44ef69dffc2..1b6ca46d1a64 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -14,6 +14,7 @@
#include <linux/pci-p2pdma.h>
#ifdef CONFIG_NVME_TARGET_AUTH
#include <linux/nvme-auth.h>
+#include <linux/key-type.h>
#endif
#include <linux/nvme-keyring.h>
#include <crypto/hash.h>
@@ -2100,15 +2101,29 @@ static struct config_group nvmet_ports_group;
static ssize_t nvmet_host_dhchap_key_show(struct config_item *item,
char *page)
{
- u8 *dhchap_secret;
+ struct nvmet_host *host = to_host(item);
+ struct key *key;
ssize_t ret;
down_read(&nvmet_config_sem);
- dhchap_secret = to_host(item)->dhchap_secret;
- if (!dhchap_secret)
- ret = sprintf(page, "\n");
- else
- ret = sprintf(page, "%s\n", dhchap_secret);
+ key = key_get(host->dhchap_key);
+ if (!key) {
+ page[0] = '\0';
+ ret = 0;
+ } else {
+ down_read(&key->sem);
+ if (key_validate(key))
+ ret = sprintf(page, "<invalidated>\n");
+ else {
+ ret = key->type->read(key, page, PAGE_SIZE);
+ if (ret > 0) {
+ page[ret] = '\n';
+ ret++;
+ }
+ }
+ up_read(&key->sem);
+ key_put(key);
+ }
up_read(&nvmet_config_sem);
return ret;
}
@@ -2133,15 +2148,29 @@ CONFIGFS_ATTR(nvmet_host_, dhchap_key);
static ssize_t nvmet_host_dhchap_ctrl_key_show(struct config_item *item,
char *page)
{
- u8 *dhchap_secret = to_host(item)->dhchap_ctrl_secret;
+ struct nvmet_host *host = to_host(item);
+ struct key *key;
ssize_t ret;
down_read(&nvmet_config_sem);
- dhchap_secret = to_host(item)->dhchap_ctrl_secret;
- if (!dhchap_secret)
- ret = sprintf(page, "\n");
- else
- ret = sprintf(page, "%s\n", dhchap_secret);
+ key = key_get(host->dhchap_ctrl_key);
+ if (!key) {
+ page[0] = '\0';
+ ret = 0;
+ } else {
+ down_read(&key->sem);
+ if (key_validate(key))
+ ret = sprintf(page, "<invalidated>\n");
+ else {
+ ret = key->type->read(key, page, PAGE_SIZE);
+ if (ret > 0) {
+ page[ret] = '\n';
+ ret++;
+ }
+ }
+ up_read(&key->sem);
+ key_put(key);
+ }
up_read(&nvmet_config_sem);
return ret;
}
@@ -2152,7 +2181,9 @@ static ssize_t nvmet_host_dhchap_ctrl_key_store(struct config_item *item,
struct nvmet_host *host = to_host(item);
int ret;
+ down_write(&nvmet_config_sem);
ret = nvmet_auth_set_key(host, page, true);
+ up_write(&nvmet_config_sem);
/*
* Re-authentication is a soft state, so keep the
* current authentication valid until the host
@@ -2233,8 +2264,8 @@ static void nvmet_host_release(struct config_item *item)
struct nvmet_host *host = to_host(item);
#ifdef CONFIG_NVME_TARGET_AUTH
- kfree(host->dhchap_secret);
- kfree(host->dhchap_ctrl_secret);
+ nvmet_auth_revoke_key(host, false);
+ nvmet_auth_revoke_key(host, true);
#endif
kfree(host);
}
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 1aa9d2176f75..d23f9d122777 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -374,10 +374,8 @@ static inline struct nvmet_subsys *namespaces_to_subsys(
struct nvmet_host {
struct config_group group;
- u8 *dhchap_secret;
- u8 *dhchap_ctrl_secret;
- u8 dhchap_key_hash;
- u8 dhchap_ctrl_key_hash;
+ struct key *dhchap_key;
+ struct key *dhchap_ctrl_key;
u8 dhchap_hash_id;
u8 dhchap_dhgroup_id;
};
@@ -880,6 +878,7 @@ u32 nvmet_auth_send_data_len(struct nvmet_req *req);
void nvmet_execute_auth_send(struct nvmet_req *req);
u32 nvmet_auth_receive_data_len(struct nvmet_req *req);
void nvmet_execute_auth_receive(struct nvmet_req *req);
+void nvmet_auth_revoke_key(struct nvmet_host *host, bool set_ctrl);
int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
bool set_ctrl);
int nvmet_auth_set_host_hash(struct nvmet_host *host, const char *hash);
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 10/12] nvme: allow to pass in key serial number as dhchap secret
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (8 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 09/12] nvmet-auth: parse dhchap key from configfs attribute Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 11/12] nvme-auth: wait for authentication to finish when changing keys Hannes Reinecke
` (3 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
In order to use pre-populated keys update the parsing for
DH-HMAC-CHAP secret to allow for a key serial number instead
of an encoded binary secret.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/common/auth.c | 22 ++++++++++---
drivers/nvme/host/auth.c | 17 ++++++++--
drivers/nvme/host/fabrics.c | 24 ++++++++++----
drivers/nvme/host/fabrics.h | 4 +++
drivers/nvme/host/nvme.h | 2 ++
drivers/nvme/host/sysfs.c | 60 ++++++++++++++++++++++------------
drivers/nvme/target/auth.c | 20 ++++++++++--
drivers/nvme/target/configfs.c | 10 +++---
drivers/nvme/target/nvmet.h | 2 ++
include/linux/nvme-auth.h | 3 +-
10 files changed, 122 insertions(+), 42 deletions(-)
diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index 8c2ccbfb9986..c47bb70b26ef 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -156,14 +156,26 @@ size_t nvme_auth_hmac_hash_len(u8 hmac_id)
EXPORT_SYMBOL_GPL(nvme_auth_hmac_hash_len);
struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret,
- size_t secret_len)
+ size_t secret_len, bool *generated)
{
+ key_serial_t key_id;
struct key *key;
- key = nvme_dhchap_psk_refresh(keyring, secret, secret_len);
- if (!IS_ERR(key))
- pr_debug("generated dhchap key %08x\n",
- key_serial(key));
+ if (kstrtouint(secret, 0, &key_id)) {
+ key = nvme_dhchap_psk_refresh(keyring,
+ secret, secret_len);
+ if (!IS_ERR(key)) {
+ *generated = true;
+ pr_debug("generated dhchap key %08x\n",
+ key_serial(key));
+ }
+ } else if (key_id > 0) {
+ key = nvme_tls_key_lookup(key_id);
+ if (!IS_ERR(key))
+ *generated = false;
+ } else {
+ key = ERR_PTR(-EINVAL);
+ }
return key;
}
EXPORT_SYMBOL_GPL(nvme_auth_extract_key);
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index d15ab5e98fe1..0f45261c50f8 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -1037,19 +1037,29 @@ static void nvme_ctrl_auth_work(struct work_struct *work)
static void nvme_auth_clear_key(struct nvme_ctrl *ctrl, bool is_ctrl)
{
struct key *key;
+ bool generated;
if (is_ctrl) {
key = ctrl->ctrl_key;
ctrl->ctrl_key = NULL;
+ generated = ctrl->ctrl_key_generated;
+ ctrl->ctrl_key_generated = false;
} else {
key = ctrl->host_key;
ctrl->host_key = NULL;
+ generated = ctrl->host_key_generated;
+ ctrl->host_key_generated = false;
}
if (key) {
- dev_dbg(ctrl->device, "%s: revoke%s key %08x\n",
+ if (generated) {
+ dev_dbg(ctrl->device, "%s: revoke%s key %08x\n",
+ __func__, is_ctrl ? " ctrl" : "",
+ key_serial(key));
+ key_revoke(key);
+ }
+ dev_dbg(ctrl->device, "%s: drop%s key %08x\n",
__func__, is_ctrl ? " ctrl" : "",
key_serial(key));
- key_revoke(key);
key_put(key);
}
}
@@ -1079,6 +1089,8 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
key_serial(ctrl->opts->dhchap_key));
return -ENOKEY;
}
+ /* Key has been generated during option parsing */
+ ctrl->host_key_generated = false;
down_read(&ctrl->host_key->sem);
ret = key_validate(ctrl->host_key);
up_read(&ctrl->host_key->sem);
@@ -1105,6 +1117,7 @@ int nvme_auth_init_ctrl(struct nvme_ctrl *ctrl)
key_serial(ctrl->opts->dhchap_ctrl_key));
return -ENOKEY;
}
+ ctrl->ctrl_key_generated = false;
down_read(&ctrl->ctrl_key->sem);
ret = key_validate(ctrl->ctrl_key);
up_read(&ctrl->ctrl_key->sem);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 009a6cf8a86b..6ec94c4f6075 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -741,7 +741,9 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
opts->keyring = NULL;
opts->concat = false;
opts->dhchap_key = NULL;
+ opts->dhchap_key_generated = false;
opts->dhchap_ctrl_key = NULL;
+ opts->dhchap_ctrl_key_generated = false;
options = o = kstrdup(buf, GFP_KERNEL);
if (!options)
@@ -1095,7 +1097,8 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
if (host_secret) {
pr_debug("lookup host identity '%s'\n", host_secret);
key = nvme_auth_extract_key(opts->keyring, host_secret,
- strlen(host_secret));
+ strlen(host_secret),
+ &opts->dhchap_key_generated);
if (IS_ERR(key)) {
ret = PTR_ERR(key);
goto out;
@@ -1110,7 +1113,8 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
}
pr_debug("lookup ctrl identity '%s'\n", ctrl_secret);
key = nvme_auth_extract_key(opts->keyring, ctrl_secret,
- strlen(ctrl_secret));
+ strlen(ctrl_secret),
+ &opts->dhchap_ctrl_key_generated);
if (IS_ERR(key)) {
ret = PTR_ERR(key);
goto out;
@@ -1315,15 +1319,23 @@ void nvmf_free_options(struct nvmf_ctrl_options *opts)
kfree(opts->host_traddr);
kfree(opts->host_iface);
if (opts->dhchap_key) {
- pr_debug("revoke dhchap key %08x\n",
+ if (opts->dhchap_key_generated) {
+ pr_debug("revoke dhchap key %08x\n",
+ key_serial(opts->dhchap_key));
+ key_revoke(opts->dhchap_key);
+ }
+ pr_debug("drop dhchap key %08x\n",
key_serial(opts->dhchap_key));
- key_revoke(opts->dhchap_key);
key_put(opts->dhchap_key);
}
if (opts->dhchap_ctrl_key) {
- pr_debug("revoke dhchap ctrl key %08x\n",
+ if (opts->dhchap_ctrl_key_generated) {
+ pr_debug("revoke dhchap ctrl key %08x\n",
+ key_serial(opts->dhchap_ctrl_key));
+ key_revoke(opts->dhchap_key);
+ }
+ pr_debug("drop dhchap ctrl key %08x\n",
key_serial(opts->dhchap_ctrl_key));
- key_revoke(opts->dhchap_key);
key_put(opts->dhchap_ctrl_key);
}
kfree(opts);
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 95a3d8ce1201..4b0ef3182f4c 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -99,6 +99,8 @@ enum {
* @dhchap_key: DH-HMAC-CHAP pre-shared key
* @dhchap_ctrl_key: DH-HMAC-CHAP controller pre-shared key for bi-directional
* authentication
+ * @dhchap_key_generated: True if the @dhchap_key has been auto-generated
+ * @dhchap_ctrl_key_generated: True if @dhchap_ctrl_key has been auto-generated
* @keyring: Keyring to use for key lookups
* @tls_key: TLS key for encrypted connections (TCP)
* @tls: Start TLS encrypted connections (TCP)
@@ -129,6 +131,8 @@ struct nvmf_ctrl_options {
struct nvmf_host *host;
struct key *dhchap_key;
struct key *dhchap_ctrl_key;
+ bool dhchap_key_generated;
+ bool dhchap_ctrl_key_generated;
struct key *keyring;
struct key *tls_key;
bool tls;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 89c84220e340..c1b4ef6c5233 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -381,6 +381,8 @@ struct nvme_ctrl {
struct key *host_key;
struct key *ctrl_key;
u16 transaction;
+ bool host_key_generated;
+ bool ctrl_key_generated;
#endif
key_serial_t tls_pskid;
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index e7a635d6037e..0f0f0608d6c8 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -581,13 +581,14 @@ static ssize_t nvme_ctrl_dhchap_secret_show(struct device *dev,
down_read(&key->sem);
if (key_validate(key))
count = sysfs_emit(buf, "<invalidated>\n");
- else {
+ else if (ctrl->host_key_generated) {
count = key->type->read(key, buf, PAGE_SIZE);
if (count > 0) {
buf[count] = '\n';
count++;
}
- }
+ } else
+ count = sysfs_emit(buf, "%08x\n", key_serial(key));
up_read(&key->sem);
return count;
}
@@ -599,6 +600,7 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
struct nvmf_ctrl_options *opts = ctrl->opts;
struct key *key, *old_key;
char *dhchap_secret;
+ bool generated = false;
size_t len;
int ret;
@@ -611,8 +613,8 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
return -ENOMEM;
memcpy(dhchap_secret, buf, len);
nvme_auth_stop(ctrl);
- key = nvme_auth_extract_key(opts->keyring,
- dhchap_secret, count);
+ key = nvme_auth_extract_key(opts->keyring, dhchap_secret, len,
+ &generated);
if (IS_ERR(key)) {
kfree(dhchap_secret);
return PTR_ERR(key);
@@ -622,19 +624,25 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
up_read(&key->sem);
if (ret) {
dev_warn(ctrl->dev, "key %08x invalidated\n", key_serial(key));
- dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
- key_revoke(key);
+ if (generated) {
+ dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
+ key_revoke(key);
+ synchronize_rcu();
+ }
key_put(key);
kfree(dhchap_secret);
return ret;
}
mutex_lock(&ctrl->dhchap_auth_mutex);
old_key = ctrl->host_key;
- dev_dbg(ctrl->dev, "revoke key %08x\n",
- key_serial(old_key));
- key_revoke(old_key);
-
+ if (ctrl->host_key_generated) {
+ dev_dbg(ctrl->dev, "revoke key %08x\n",
+ key_serial(old_key));
+ key_revoke(old_key);
+ synchronize_rcu();
+ }
ctrl->host_key = key;
+ ctrl->host_key_generated = generated;
mutex_unlock(&ctrl->dhchap_auth_mutex);
key_put(old_key);
kfree(dhchap_secret);
@@ -660,13 +668,14 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
down_read(&key->sem);
if (key_validate(key))
count = sysfs_emit(buf, "<invalidated>");
- else {
+ else if (ctrl->ctrl_key_generated) {
count = key->type->read(key, buf, PAGE_SIZE);
if (count > 0) {
buf[count] = '\n';
count++;
}
- }
+ } else
+ count = sysfs_emit(buf, "%08x\n", key_serial(key));
up_read(&key->sem);
return count;
}
@@ -678,6 +687,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
struct nvmf_ctrl_options *opts = ctrl->opts;
struct key *key, *old_key;
char *dhchap_secret;
+ bool generated = false;
size_t len;
int ret;
@@ -690,8 +700,8 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
return -ENOMEM;
memcpy(dhchap_secret, buf, len);
nvme_auth_stop(ctrl);
- key = nvme_auth_extract_key(opts->keyring,
- dhchap_secret, count);
+ key = nvme_auth_extract_key(opts->keyring, dhchap_secret, len,
+ &generated);
if (IS_ERR(key)) {
kfree(dhchap_secret);
return PTR_ERR(key);
@@ -701,18 +711,25 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
up_read(&key->sem);
if (ret) {
dev_warn(ctrl->dev, "key %08x invalidated\n", key_serial(key));
- dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
- key_revoke(key);
+ if (generated) {
+ dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
+ key_revoke(key);
+ synchronize_rcu();
+ }
key_put(key);
kfree(dhchap_secret);
return ret;
}
mutex_lock(&ctrl->dhchap_auth_mutex);
old_key = ctrl->ctrl_key;
- dev_dbg(ctrl->dev, "revoke key %08x\n",
- key_serial(old_key));
- key_revoke(old_key);
+ if (ctrl->ctrl_key_generated) {
+ dev_dbg(ctrl->dev, "revoke key %08x\n",
+ key_serial(old_key));
+ key_revoke(old_key);
+ synchronize_rcu();
+ }
ctrl->ctrl_key = key;
+ ctrl->ctrl_key_generated = generated;
mutex_unlock(&ctrl->dhchap_auth_mutex);
key_put(old_key);
kfree(dhchap_secret);
@@ -738,13 +755,14 @@ static ssize_t dhchap_key_show(struct device *dev,
down_read(&key->sem);
if (key_validate(key))
count = sysfs_emit(buf, "<invalidated>\n");
- else {
+ else if (ctrl->host_key_generated) {
count = key->type->read(key, buf, PAGE_SIZE);
if (count > 0) {
buf[count] = '\n';
count++;
}
- }
+ } else
+ count = sysfs_emit(buf, "%08x\n", key_serial(ctrl->host_key));
up_read(&key->sem);
return count;
}
diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 59394587a875..3f9fad732350 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -23,23 +23,34 @@
void nvmet_auth_revoke_key(struct nvmet_host *host, bool set_ctrl)
{
struct key *key = ERR_PTR(-ENOKEY);
+ bool generated = false;
if (set_ctrl) {
if (host->dhchap_ctrl_key) {
key = host->dhchap_ctrl_key;
+ generated = host->dhchap_ctrl_key_generated;
host->dhchap_ctrl_key = NULL;
+ host->dhchap_ctrl_key_generated = false;
}
} else {
if (host->dhchap_key) {
key = host->dhchap_key;
+ generated = host->dhchap_key_generated;
host->dhchap_key = NULL;
+ host->dhchap_key_generated = false;
}
}
if (!IS_ERR(key)) {
- pr_debug("%s: revoke %s key %08x\n",
+ if (generated) {
+ pr_debug("%s: revoke %s key %08x\n",
+ __func__, set_ctrl ? "ctrl" : "host",
+ key_serial(key));
+ key_revoke(key);
+ synchronize_rcu();
+ }
+ pr_debug("%s: drop %s key %08x\n",
__func__, set_ctrl ? "ctrl" : "host",
key_serial(key));
- key_revoke(key);
key_put(key);
}
}
@@ -48,6 +59,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
bool set_ctrl)
{
unsigned char key_hash;
+ bool generated = false;
struct key *key;
size_t len;
@@ -57,7 +69,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
}
len = strcspn(secret, "\n");
- key = nvme_auth_extract_key(NULL, secret, len);
+ key = nvme_auth_extract_key(NULL, secret, len, &generated);
if (IS_ERR(key)) {
pr_debug("%s: invalid key specification\n", __func__);
return PTR_ERR(key);
@@ -87,8 +99,10 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
nvmet_auth_revoke_key(host, set_ctrl);
if (set_ctrl) {
host->dhchap_ctrl_key = key;
+ host->dhchap_ctrl_key_generated = generated;
} else {
host->dhchap_key = key;
+ host->dhchap_key_generated = generated;
}
return 0;
}
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 1b6ca46d1a64..2f308108159c 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -2114,13 +2114,14 @@ static ssize_t nvmet_host_dhchap_key_show(struct config_item *item,
down_read(&key->sem);
if (key_validate(key))
ret = sprintf(page, "<invalidated>\n");
- else {
+ else if (host->dhchap_key_generated) {
ret = key->type->read(key, page, PAGE_SIZE);
if (ret > 0) {
page[ret] = '\n';
ret++;
}
- }
+ } else
+ ret = sprintf(page, "%08x\n", key_serial(key));
up_read(&key->sem);
key_put(key);
}
@@ -2161,13 +2162,14 @@ static ssize_t nvmet_host_dhchap_ctrl_key_show(struct config_item *item,
down_read(&key->sem);
if (key_validate(key))
ret = sprintf(page, "<invalidated>\n");
- else {
+ else if (host->dhchap_ctrl_key_generated) {
ret = key->type->read(key, page, PAGE_SIZE);
if (ret > 0) {
page[ret] = '\n';
ret++;
}
- }
+ } else
+ ret = sprintf(page, "%08x\n", key_serial(key));
up_read(&key->sem);
key_put(key);
}
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index d23f9d122777..2a1c3850a8ac 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -375,7 +375,9 @@ static inline struct nvmet_subsys *namespaces_to_subsys(
struct nvmet_host {
struct config_group group;
struct key *dhchap_key;
+ bool dhchap_key_generated;
struct key *dhchap_ctrl_key;
+ bool dhchap_ctrl_key_generated;
u8 dhchap_hash_id;
u8 dhchap_dhgroup_id;
};
diff --git a/include/linux/nvme-auth.h b/include/linux/nvme-auth.h
index 4e53ef96eea7..a9ae1d60a5f9 100644
--- a/include/linux/nvme-auth.h
+++ b/include/linux/nvme-auth.h
@@ -18,7 +18,8 @@ const char *nvme_auth_digest_name(u8 hmac_id);
size_t nvme_auth_hmac_hash_len(u8 hmac_id);
u8 nvme_auth_hmac_id(const char *hmac_name);
-struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret, size_t secret_len);
+struct key *nvme_auth_extract_key(struct key *keyring, const u8 *secret, size_t secret_len,
+ bool *generated);
int nvme_auth_transform_key(struct key *key, char *nqn,
u8 **transformed_secret);
int nvme_auth_augmented_challenge(u8 hmac_id, u8 *skey, size_t skey_len,
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 11/12] nvme-auth: wait for authentication to finish when changing keys
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (9 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 10/12] nvme: allow to pass in key serial number as dhchap secret Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 12/12] nvme: Unify Kconfig settings Hannes Reinecke
` (2 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
When changing DH-HMAC-CHAP keys in sysfs we need to wait for authentication
to complete on all queues. Otherwise the user might change the keys while
authentication is in progress, causing the authentication to fail and
I/O to be interrupted.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/host/sysfs.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 0f0f0608d6c8..db4474dda64c 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -649,7 +649,7 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
queue_work(nvme_wq, &ctrl->dhchap_auth_work);
-
+ flush_work(&ctrl->dhchap_auth_work);
return count;
}
@@ -714,7 +714,6 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
if (generated) {
dev_dbg(ctrl->dev, "revoke key %08x\n", key_serial(key));
key_revoke(key);
- synchronize_rcu();
}
key_put(key);
kfree(dhchap_secret);
@@ -726,7 +725,6 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
dev_dbg(ctrl->dev, "revoke key %08x\n",
key_serial(old_key));
key_revoke(old_key);
- synchronize_rcu();
}
ctrl->ctrl_key = key;
ctrl->ctrl_key_generated = generated;
@@ -736,7 +734,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
/* Start re-authentication */
dev_info(ctrl->device, "re-authenticating controller\n");
queue_work(nvme_wq, &ctrl->dhchap_auth_work);
-
+ flush_work(&ctrl->dhchap_auth_work);
return count;
}
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* [PATCH 12/12] nvme: Unify Kconfig settings
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (10 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 11/12] nvme-auth: wait for authentication to finish when changing keys Hannes Reinecke
@ 2025-04-25 9:49 ` Hannes Reinecke
2025-05-07 7:23 ` Christoph Hellwig
2025-05-07 7:19 ` [PATCH 00/12] nvme-auth: switch to use the kernel keyring Christoph Hellwig
2025-05-07 7:53 ` Sagi Grimberg
13 siblings, 1 reply; 26+ messages in thread
From: Hannes Reinecke @ 2025-04-25 9:49 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: Keith Busch, Sagi Grimberg, linux-nvme, Hannes Reinecke
As authentication now requires the keyring to be present streamline the
Kconfig setting to always select the same symbols for both host and target.
Signed-off-by: Hannes Reinecke <hare@kernel.org>
---
drivers/nvme/host/Kconfig | 3 ++-
drivers/nvme/target/Kconfig | 2 ++
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index e7fb34fdc28b..4873c22d89d1 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -100,8 +100,9 @@ config NVME_TCP
config NVME_TCP_TLS
bool "NVMe over Fabrics TCP TLS encryption support"
depends on NVME_TCP
+ select TLS
select NET_HANDSHAKE
- select KEYS
+ select NVME_KEYRING
help
Enables TLS encryption for NVMe TCP using the netlink handshake API.
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 28b5229c48e2..14e2a484527c 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -96,7 +96,9 @@ config NVME_TARGET_TCP
config NVME_TARGET_TCP_TLS
bool "NVMe over Fabrics TCP target TLS encryption support"
depends on NVME_TARGET_TCP
+ select TLS
select NET_HANDSHAKE
+ select NVME_KEYRING
help
Enables TLS encryption for the NVMe TCP target using the netlink handshake API.
--
2.35.3
^ permalink raw reply related [flat|nested] 26+ messages in thread
* Re: [PATCH 00/12] nvme-auth: switch to use the kernel keyring
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (11 preceding siblings ...)
2025-04-25 9:49 ` [PATCH 12/12] nvme: Unify Kconfig settings Hannes Reinecke
@ 2025-05-07 7:19 ` Christoph Hellwig
2025-05-07 7:42 ` Hannes Reinecke
2025-05-07 7:53 ` Sagi Grimberg
13 siblings, 1 reply; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:19 UTC (permalink / raw)
To: Hannes Reinecke; +Cc: Christoph Hellwig, Keith Busch, Sagi Grimberg, linux-nvme
Can you create documentation on how to actually use the keyring
interface? As I just got into the TLS the complete lack of documentation
there left me a bit stunned and I'd rather avoid that for new interfaces.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 12/12] nvme: Unify Kconfig settings
2025-04-25 9:49 ` [PATCH 12/12] nvme: Unify Kconfig settings Hannes Reinecke
@ 2025-05-07 7:23 ` Christoph Hellwig
2025-05-07 7:30 ` Hannes Reinecke
0 siblings, 1 reply; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:23 UTC (permalink / raw)
To: Hannes Reinecke; +Cc: Christoph Hellwig, Keith Busch, Sagi Grimberg, linux-nvme
On Fri, Apr 25, 2025 at 11:49:27AM +0200, Hannes Reinecke wrote:
> As authentication now requires the keyring to be present streamline the
> Kconfig setting to always select the same symbols for both host and target.
This fails to apply with the select tcp fixes from Alistair.
But I also totally fail to understand the commit message. Either
some library code is needed and we need to select it, or it is not
and we don't need it. Being uniform should not matter.
So when respinning this please explain what is fixed, and split it into
separate host vs target patches.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status
2025-04-25 9:49 ` [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status Hannes Reinecke
@ 2025-05-07 7:24 ` Christoph Hellwig
2025-05-07 7:29 ` Hannes Reinecke
0 siblings, 1 reply; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:24 UTC (permalink / raw)
To: Hannes Reinecke; +Cc: Christoph Hellwig, Keith Busch, Sagi Grimberg, linux-nvme
On Fri, Apr 25, 2025 at 11:49:16AM +0200, Hannes Reinecke wrote:
> Modify nvme_auth_transform_key() to return a status and provide
> the transformed data as argument on the command line as raw data.
Well, it's pretty obvious that you do this from the code changes.
But why do you change it?
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 04/12] nvme-auth: do not cache the transformed secret
2025-04-25 9:49 ` [PATCH 04/12] nvme-auth: do not cache the transformed secret Hannes Reinecke
@ 2025-05-07 7:25 ` Christoph Hellwig
0 siblings, 0 replies; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:25 UTC (permalink / raw)
To: Hannes Reinecke; +Cc: Christoph Hellwig, Keith Busch, Sagi Grimberg, linux-nvme
On Fri, Apr 25, 2025 at 11:49:19AM +0200, Hannes Reinecke wrote:
> Only saving so much, and doesn't bring much benefit.
Sabing what? Please spell out the rationale a bit better, the above
leaves me more confused than before.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions
2025-04-25 9:49 ` [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions Hannes Reinecke
@ 2025-05-07 7:26 ` Christoph Hellwig
2025-05-07 7:30 ` Hannes Reinecke
0 siblings, 1 reply; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:26 UTC (permalink / raw)
To: Hannes Reinecke; +Cc: Christoph Hellwig, Keith Busch, Sagi Grimberg, linux-nvme
On Fri, Apr 25, 2025 at 11:49:22AM +0200, Hannes Reinecke wrote:
> Drop the hand-crafted nvme_dhchap_key structure and the now unused
> functions.
This should go into the previous patch instead of just creating dead
code there.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK
2025-04-25 9:49 ` [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK Hannes Reinecke
@ 2025-05-07 7:28 ` Christoph Hellwig
2025-05-07 7:29 ` Hannes Reinecke
0 siblings, 1 reply; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:28 UTC (permalink / raw)
To: Hannes Reinecke; +Cc: Christoph Hellwig, Keith Busch, Sagi Grimberg, linux-nvme
On Fri, Apr 25, 2025 at 11:49:17AM +0200, Hannes Reinecke wrote:
> Use SHASH_DESC_ON_STACK to avoid explicit allocation.
Can you send these two as standalone patches for ASAP inclusion,
please? They look nice and unrelated to the rest of the series.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status
2025-05-07 7:24 ` Christoph Hellwig
@ 2025-05-07 7:29 ` Hannes Reinecke
0 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-05-07 7:29 UTC (permalink / raw)
To: Christoph Hellwig, Hannes Reinecke; +Cc: Keith Busch, Sagi Grimberg, linux-nvme
On 5/7/25 09:24, Christoph Hellwig wrote:
> On Fri, Apr 25, 2025 at 11:49:16AM +0200, Hannes Reinecke wrote:
>> Modify nvme_auth_transform_key() to return a status and provide
>> the transformed data as argument on the command line as raw data.
>
> Well, it's pretty obvious that you do this from the code changes.
>
> But why do you change it?
>
You are right, the description is incorrect.
Main point here is to return a raw byte string containing the
transformed key data (and not a key structure).
Doing so makes the following modifications easier to read.
One hopes.
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK
2025-05-07 7:28 ` Christoph Hellwig
@ 2025-05-07 7:29 ` Hannes Reinecke
2025-05-07 7:35 ` Christoph Hellwig
0 siblings, 1 reply; 26+ messages in thread
From: Hannes Reinecke @ 2025-05-07 7:29 UTC (permalink / raw)
To: Christoph Hellwig, Hannes Reinecke; +Cc: Keith Busch, Sagi Grimberg, linux-nvme
On 5/7/25 09:28, Christoph Hellwig wrote:
> On Fri, Apr 25, 2025 at 11:49:17AM +0200, Hannes Reinecke wrote:
>> Use SHASH_DESC_ON_STACK to avoid explicit allocation.
>
> Can you send these two as standalone patches for ASAP inclusion,
> please? They look nice and unrelated to the rest of the series.
>
Why, sure.
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions
2025-05-07 7:26 ` Christoph Hellwig
@ 2025-05-07 7:30 ` Hannes Reinecke
0 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-05-07 7:30 UTC (permalink / raw)
To: Christoph Hellwig, Hannes Reinecke; +Cc: Keith Busch, Sagi Grimberg, linux-nvme
On 5/7/25 09:26, Christoph Hellwig wrote:
> On Fri, Apr 25, 2025 at 11:49:22AM +0200, Hannes Reinecke wrote:
>> Drop the hand-crafted nvme_dhchap_key structure and the now unused
>> functions.
>
> This should go into the previous patch instead of just creating dead
> code there.
>
Will be doing so for the next round.
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 12/12] nvme: Unify Kconfig settings
2025-05-07 7:23 ` Christoph Hellwig
@ 2025-05-07 7:30 ` Hannes Reinecke
0 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-05-07 7:30 UTC (permalink / raw)
To: Christoph Hellwig, Hannes Reinecke; +Cc: Keith Busch, Sagi Grimberg, linux-nvme
On 5/7/25 09:23, Christoph Hellwig wrote:
> On Fri, Apr 25, 2025 at 11:49:27AM +0200, Hannes Reinecke wrote:
>> As authentication now requires the keyring to be present streamline the
>> Kconfig setting to always select the same symbols for both host and target.
>
> This fails to apply with the select tcp fixes from Alistair.
>
> But I also totally fail to understand the commit message. Either
> some library code is needed and we need to select it, or it is not
> and we don't need it. Being uniform should not matter.
>
> So when respinning this please explain what is fixed, and split it into
> separate host vs target patches.
>
Sure.
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK
2025-05-07 7:29 ` Hannes Reinecke
@ 2025-05-07 7:35 ` Christoph Hellwig
0 siblings, 0 replies; 26+ messages in thread
From: Christoph Hellwig @ 2025-05-07 7:35 UTC (permalink / raw)
To: Hannes Reinecke
Cc: Christoph Hellwig, Hannes Reinecke, Keith Busch, Sagi Grimberg,
linux-nvme
On Wed, May 07, 2025 at 09:29:41AM +0200, Hannes Reinecke wrote:
>> Can you send these two as standalone patches for ASAP inclusion,
>> please? They look nice and unrelated to the rest of the series.
>>
> Why,
Because it's nice to be able to queue up obvious simplifications and
speedups ASAP while features tend to go through longer review cycles.
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 00/12] nvme-auth: switch to use the kernel keyring
2025-05-07 7:19 ` [PATCH 00/12] nvme-auth: switch to use the kernel keyring Christoph Hellwig
@ 2025-05-07 7:42 ` Hannes Reinecke
0 siblings, 0 replies; 26+ messages in thread
From: Hannes Reinecke @ 2025-05-07 7:42 UTC (permalink / raw)
To: Christoph Hellwig, Hannes Reinecke; +Cc: Keith Busch, Sagi Grimberg, linux-nvme
On 5/7/25 09:19, Christoph Hellwig wrote:
> Can you create documentation on how to actually use the keyring
> interface? As I just got into the TLS the complete lack of documentation
> there left me a bit stunned and I'd rather avoid that for new interfaces.
>
Well ... We _do_ have a wiki page on the nvme-cli github:
https://github.com/linux-nvme/nvme-cli/wiki/How-to-Set-Up-TLS-for-NVMe%E2%80%90TCP
which I found a better place than the kernel Documentation.
It does lack information about secure concatenation, true; I'll be
adding that. And we have blktests for TLS and secure concatenation
nowadays (nvme/062 and nvme/063).
I'll probably add another blktest for the new interface to test
with pre-populated keys.
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 26+ messages in thread
* Re: [PATCH 00/12] nvme-auth: switch to use the kernel keyring
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
` (12 preceding siblings ...)
2025-05-07 7:19 ` [PATCH 00/12] nvme-auth: switch to use the kernel keyring Christoph Hellwig
@ 2025-05-07 7:53 ` Sagi Grimberg
13 siblings, 0 replies; 26+ messages in thread
From: Sagi Grimberg @ 2025-05-07 7:53 UTC (permalink / raw)
To: Hannes Reinecke, Christoph Hellwig; +Cc: Keith Busch, linux-nvme
On 25/04/2025 12:49, Hannes Reinecke wrote:
> Hey all,
>
> the current NVMe authentication code is using a hand-crafted key structure;
> idea was to have the initial implementation with a minimal set of dependencies.
> (And me not having a good grasp on how to use the kernel keyring :-)
> That had the drawback that keys always had to be specified on the nvme-cli
> commandline, which is far from ideal from a security standpoint.
>
> So this patchset switches the authentication code over to use the kernel keyring.
> User-facing interface (namely argument to 'nvme connect') remain the same, but
> the key data is converted into keys which are stored as a new key type 'dhchap'
> with a random UUID as description in the kernel keyring.
A welcome change Hannes.
Did not look into the patches yet, but we should start logging deprecation
messages on the existing interface I think.
^ permalink raw reply [flat|nested] 26+ messages in thread
end of thread, other threads:[~2025-05-07 8:45 UTC | newest]
Thread overview: 26+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-25 9:49 [PATCH 00/12] nvme-auth: switch to use the kernel keyring Hannes Reinecke
2025-04-25 9:49 ` [PATCH 01/12] nvme-auth: modify nvme_auth_transform_key() to return status Hannes Reinecke
2025-05-07 7:24 ` Christoph Hellwig
2025-05-07 7:29 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 02/12] nvme-auth: use SHASH_DESC_ON_STACK Hannes Reinecke
2025-05-07 7:28 ` Christoph Hellwig
2025-05-07 7:29 ` Hannes Reinecke
2025-05-07 7:35 ` Christoph Hellwig
2025-04-25 9:49 ` [PATCH 03/12] nvmet-auth: " Hannes Reinecke
2025-04-25 9:49 ` [PATCH 04/12] nvme-auth: do not cache the transformed secret Hannes Reinecke
2025-05-07 7:25 ` Christoph Hellwig
2025-04-25 9:49 ` [PATCH 05/12] nvme-keyring: add 'dhchap' key type Hannes Reinecke
2025-04-25 9:49 ` [PATCH 06/12] nvme-auth: switch to use 'struct key' Hannes Reinecke
2025-04-25 9:49 ` [PATCH 07/12] nvme-auth: drop nvme_dhchap_key structure and unused functions Hannes Reinecke
2025-05-07 7:26 ` Christoph Hellwig
2025-05-07 7:30 ` Hannes Reinecke
2025-04-25 9:49 ` [PATCH 08/12] nvme: parse dhchap keys during option parsing Hannes Reinecke
2025-04-25 9:49 ` [PATCH 09/12] nvmet-auth: parse dhchap key from configfs attribute Hannes Reinecke
2025-04-25 9:49 ` [PATCH 10/12] nvme: allow to pass in key serial number as dhchap secret Hannes Reinecke
2025-04-25 9:49 ` [PATCH 11/12] nvme-auth: wait for authentication to finish when changing keys Hannes Reinecke
2025-04-25 9:49 ` [PATCH 12/12] nvme: Unify Kconfig settings Hannes Reinecke
2025-05-07 7:23 ` Christoph Hellwig
2025-05-07 7:30 ` Hannes Reinecke
2025-05-07 7:19 ` [PATCH 00/12] nvme-auth: switch to use the kernel keyring Christoph Hellwig
2025-05-07 7:42 ` Hannes Reinecke
2025-05-07 7:53 ` Sagi Grimberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox