From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEBE72582 for ; Wed, 29 Mar 2023 13:59:57 +0000 (UTC) Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out2.suse.de (Postfix) with ESMTP id A539C1FDD1; Wed, 29 Mar 2023 13:59:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1680098389; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O8R546K7ElYFsQIJKUpHBEP2g9n5bn4ZN45DSBkF4BE=; b=dea7eqgRK3r+F1+ENAHeTeIUzMGWCwPbayMHBo8RxvpABUrB8/nNurKjH26zvDgbrZf+93 1t7KHJCyNgYYU4vRh9qBT+U0eUundprvMX2BfUFolMe8YATb9vMbwtE3NJk4xNY5DUU8Q1 GCExkBug0xy43UwcYLd5vvmjPzevRx8= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1680098389; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O8R546K7ElYFsQIJKUpHBEP2g9n5bn4ZN45DSBkF4BE=; b=oxGTEN6WCs2KYl9tJaKVf3t2W4nJsP12B0wjqQQoSLoObaw4KT+mvRzftRkrpZ2mzMrI8a mlmi1cts0fbb+bAw== Received: from adalid.arch.suse.de (adalid.arch.suse.de [10.161.8.13]) by relay2.suse.de (Postfix) with ESMTP id 88CE32C165; Wed, 29 Mar 2023 13:59:49 +0000 (UTC) Received: by adalid.arch.suse.de (Postfix, from userid 16045) id 7DB7D51BF376; Wed, 29 Mar 2023 15:59:49 +0200 (CEST) From: Hannes Reinecke To: Christoph Hellwig Cc: Sagi Grimberg , Keith Busch , linux-nvme@lists.infradead.org, Chuck Lever , kernel-tls-handshake@lists.linux.dev, Hannes Reinecke Subject: [PATCH 02/18] nvme-keyring: define a 'psk' keytype Date: Wed, 29 Mar 2023 15:59:22 +0200 Message-Id: <20230329135938.46905-3-hare@suse.de> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20230329135938.46905-1-hare@suse.de> References: <20230329135938.46905-1-hare@suse.de> Precedence: bulk X-Mailing-List: kernel-tls-handshake@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Define a 'psk' keytype to hold the NVMe TLS PSKs. Signed-off-by: Hannes Reinecke --- drivers/nvme/common/keyring.c | 98 +++++++++++++++++++++++++++++++++++ include/linux/nvme-keyring.h | 6 +++ 2 files changed, 104 insertions(+) diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c index 3a6e8a0b38e2..4ac33538f839 100644 --- a/drivers/nvme/common/keyring.c +++ b/drivers/nvme/common/keyring.c @@ -5,12 +5,104 @@ #include #include +#include #include #include #include static struct key *nvme_keyring; +key_serial_t nvme_keyring_id(void) +{ + return nvme_keyring->serial; +} +EXPORT_SYMBOL_GPL(nvme_keyring_id); + +static void nvme_tls_psk_describe(const struct key *key, struct seq_file *m) +{ + seq_puts(m, key->description); + seq_printf(m, ": %u", key->datalen); +} + +static bool nvme_tls_psk_match(const struct key *key, + const struct key_match_data *match_data) +{ + const char *match_id; + size_t match_len; + + if (!key->description) { + pr_debug("%s: no key description\n", __func__); + return false; + } + match_len = strlen(key->description); + pr_debug("%s: id %s len %zd\n", __func__, key->description, match_len); + + if (!match_data->raw_data) { + pr_debug("%s: no match data\n", __func__); + return false; + } + match_id = match_data->raw_data; + pr_debug("%s: match '%s' '%s' len %zd\n", + __func__, match_id, key->description, match_len); + return !memcmp(key->description, match_id, match_len); +} + +static int nvme_tls_psk_match_preparse(struct key_match_data *match_data) +{ + match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE; + match_data->cmp = nvme_tls_psk_match; + return 0; +} + +static struct key_type nvme_tls_psk_key_type = { + .name = "psk", + .flags = KEY_TYPE_NET_DOMAIN, + .preparse = user_preparse, + .free_preparse = user_free_preparse, + .match_preparse = nvme_tls_psk_match_preparse, + .instantiate = generic_key_instantiate, + .revoke = user_revoke, + .destroy = user_destroy, + .describe = nvme_tls_psk_describe, + .read = user_read, +}; + +struct key *nvme_tls_psk_lookup(struct key *keyring, + const char *hostnqn, const char *subnqn, + int hmac, bool generated) +{ + char *identity; + size_t identity_len = (NVMF_NQN_SIZE) * 2 + 11; + key_ref_t keyref; + key_serial_t keyring_id; + + identity = kzalloc(identity_len, GFP_KERNEL); + if (!identity) + return ERR_PTR(-ENOMEM); + + snprintf(identity, identity_len, "NVMe0%c%02d %s %s", + generated ? 'G' : 'R', hmac, hostnqn, subnqn); + + if (!keyring) + keyring = nvme_keyring; + keyring_id = key_serial(keyring); + pr_debug("keyring %x lookup tls psk '%s'\n", + keyring_id, identity); + keyref = keyring_search(make_key_ref(keyring, true), + &nvme_tls_psk_key_type, + identity, false); + if (IS_ERR(keyref)) { + pr_debug("lookup tls psk '%s' failed, error %ld\n", + identity, PTR_ERR(keyref)); + kfree(identity); + return ERR_PTR(-ENOKEY); + } + kfree(identity); + + return key_ref_to_ptr(keyref); +} +EXPORT_SYMBOL_GPL(nvme_tls_psk_lookup); + int nvme_keyring_init(void) { int err; @@ -24,12 +116,18 @@ int nvme_keyring_init(void) if (IS_ERR(nvme_keyring)) return PTR_ERR(nvme_keyring); + err = register_key_type(&nvme_tls_psk_key_type); + if (err) { + key_put(nvme_keyring); + return err; + } return 0; } EXPORT_SYMBOL_GPL(nvme_keyring_init); void nvme_keyring_exit(void) { + unregister_key_type(&nvme_tls_psk_key_type); key_revoke(nvme_keyring); key_put(nvme_keyring); } diff --git a/include/linux/nvme-keyring.h b/include/linux/nvme-keyring.h index a875c06cc922..5be60485ddfa 100644 --- a/include/linux/nvme-keyring.h +++ b/include/linux/nvme-keyring.h @@ -6,6 +6,12 @@ #ifndef _NVME_KEYRING_H #define _NVME_KEYRING_H +struct key *nvme_tls_psk_lookup(struct key *keyring, + const char *hostnqn, const char *subnqn, + int hmac, bool generated); + +key_serial_t nvme_keyring_id(void); + int nvme_keyring_init(void); void nvme_keyring_exit(void); -- 2.35.3