| c5931d59 | 21-Aug-2025 |
Chris Leech <cleech@redhat.com> |
nvme-auth: use hkdf_expand_label()
When generating keying material during an authentication transaction (secure channel concatenation), the HKDF-Expand-Label function is part of the specified key de
nvme-auth: use hkdf_expand_label()
When generating keying material during an authentication transaction (secure channel concatenation), the HKDF-Expand-Label function is part of the specified key derivation process.
The current open-coded implementation misses the length prefix requirements on the HkdfLabel label and context variable-length vectors (RFC 8446 Section 3.4).
Instead, use the hkdf_expand_label() function.
Signed-off-by: Chris Leech <cleech@redhat.com> Signed-off-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 9d5c0fff | 24-Feb-2025 |
Hannes Reinecke <hare@kernel.org> |
nvme: add nvme_auth_derive_tls_psk()
Add a function to derive the TLS PSK as specified TP8018.
Signed-off-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-
nvme: add nvme_auth_derive_tls_psk()
Add a function to derive the TLS PSK as specified TP8018.
Signed-off-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 71972b9f | 24-Feb-2025 |
Hannes Reinecke <hare@kernel.org> |
nvme: add nvme_auth_generate_digest()
Add a function to calculate the PSK digest as specified in TP8018.
Signed-off-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Sagi Grimberg <sagi@grimberg.m
nvme: add nvme_auth_generate_digest()
Add a function to calculate the PSK digest as specified in TP8018.
Signed-off-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 5bc46b49 | 22-Jul-2024 |
Hannes Reinecke <hare@kernel.org> |
nvme-tcp: check for invalidated or revoked key
key_lookup() will always return a key, even if that key is revoked or invalidated. So check for invalid keys before continuing.
Signed-off-by: Hannes
nvme-tcp: check for invalidated or revoked key
key_lookup() will always return a key, even if that key is revoked or invalidated. So check for invalid keys before continuing.
Signed-off-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 706add13 | 26-Oct-2023 |
Hannes Reinecke <hare@suse.de> |
nvme: keyring: fix conditional compilation
The keyring and auth functions can be called from both the host and the target side and are controlled by Kconfig options for each of the combinations, but
nvme: keyring: fix conditional compilation
The keyring and auth functions can be called from both the host and the target side and are controlled by Kconfig options for each of the combinations, but the declarations are controlled by #ifdef checks on the shared Kconfig symbols.
This leads to link failures in combinations where one of the frontends is built-in and the other one is a module, and the keyring code ends up in a module that is not reachable from the builtin code:
ld: drivers/nvme/host/core.o: in function `nvme_core_exit': core.c:(.exit.text+0x4): undefined reference to `nvme_keyring_exit' ld: drivers/nvme/host/core.o: in function `nvme_core_init': core.c:(.init.text+0x94): undefined reference to `nvme_keyring_init
ld: drivers/nvme/host/tcp.o: in function `nvme_tcp_setup_ctrl': tcp.c:(.text+0x4c18): undefined reference to `nvme_tls_psk_default'
Address this by moving nvme_keyring_init()/nvme_keyring_exit() into module init/exit functions for the keyring module.
Fixes: be8e82caa6859 ("nvme-tcp: enable TLS handshake upcall") Signed-off-by: Hannes Reinecke <hare@suse.de> Cc: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 6affe08a | 26-Oct-2023 |
Arnd Bergmann <arnd@arndb.de> |
nvme: common: make keyring and auth separate modules
When only the keyring module is included but auth is not, modpost complains about the lack of a module license tag:
ERROR: modpost: missing MODU
nvme: common: make keyring and auth separate modules
When only the keyring module is included but auth is not, modpost complains about the lack of a module license tag:
ERROR: modpost: missing MODULE_LICENSE() in drivers/nvme/common/nvme-common.o
Address this by making both modules buildable standalone, removing the now unnecessary CONFIG_NVME_COMMON symbol in the process.
Also, now that NVME_KEYRING config symbol can be either a module or built-in, the stubs need to check for '#if IS_ENABLED' rather than a simple '#ifdef'.
Fixes: 9d77eb5277849 ("nvme-keyring: register '.nvme' keyring") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 32445526 | 17-Oct-2023 |
Mark O'Donovan <shiftee@posteo.net> |
nvme-auth: allow mixing of secret and hash lengths
We can now use any of the secret transformation hashes with a secret, regardless of the secret size. e.g. a 32 byte key with the SHA-512(64 byte) h
nvme-auth: allow mixing of secret and hash lengths
We can now use any of the secret transformation hashes with a secret, regardless of the secret size. e.g. a 32 byte key with the SHA-512(64 byte) hash.
The example secret from the spec should now be permitted with any of the following: DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: DHHC-1:01:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: DHHC-1:02:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: DHHC-1:03:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:
Note: Secrets are still restricted to 32,48 or 64 bits.
Co-developed-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Mark O'Donovan <shiftee@posteo.net> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| f047daed | 17-Oct-2023 |
Mark O'Donovan <shiftee@posteo.net> |
nvme-auth: use transformed key size to create resp
This does not change current behaviour as the driver currently verifies that the secret size is the same size as the length of the transformation h
nvme-auth: use transformed key size to create resp
This does not change current behaviour as the driver currently verifies that the secret size is the same size as the length of the transformation hash.
Co-developed-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Mark O'Donovan <shiftee@posteo.net> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 3ebed374 | 17-Oct-2023 |
Mark O'Donovan <shiftee@posteo.net> |
nvme-auth: alloc nvme_dhchap_key as single buffer
Co-developed-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Mark O'Donovan <shiftee
nvme-auth: alloc nvme_dhchap_key as single buffer
Co-developed-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Akash Appaiah <Akash.Appaiah@dell.com> Signed-off-by: Mark O'Donovan <shiftee@posteo.net> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 501cc6f4 | 24-Aug-2023 |
Hannes Reinecke <hare@suse.de> |
nvme-keyring: implement nvme_tls_psk_default()
Implement a function to select the preferred PSK for TLS. A 'retained' PSK should be preferred over a 'generated' PSK, and SHA-384 should be preferred
nvme-keyring: implement nvme_tls_psk_default()
Implement a function to select the preferred PSK for TLS. A 'retained' PSK should be preferred over a 'generated' PSK, and SHA-384 should be preferred to SHA-256.
Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|
| 3bac969b | 24-Aug-2023 |
Hannes Reinecke <hare@suse.de> |
nvme-keyring: define a 'psk' keytype
Define a 'psk' keytype to hold the NVMe TLS PSKs.
Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Kei
nvme-keyring: define a 'psk' keytype
Define a 'psk' keytype to hold the NVMe TLS PSKs.
Signed-off-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
show more ...
|