Re: [PATCH 07/18] nvme-keyring: implement nvme_tls_psk_default()

From: Sagi Grimberg <sagi@grimberg.me>
To: Hannes Reinecke <hare@suse.de>, Christoph Hellwig <hch@lst.de>
Cc: Keith Busch <kbusch@kernel.org>,
	linux-nvme@lists.infradead.org,
	Chuck Lever <chuck.lever@oracle.com>,
	kernel-tls-handshake@lists.linux.dev
Subject: Re: [PATCH 07/18] nvme-keyring: implement nvme_tls_psk_default()
Date: Wed, 29 Mar 2023 18:35:37 +0300	[thread overview]
Message-ID: <ea017b62-2b01-c655-823e-c3dfefca59a1@grimberg.me> (raw)
In-Reply-To: <20230329135938.46905-8-hare@suse.de>

On 3/29/23 16:59, Hannes Reinecke wrote:
> Implement a function to select the 'best' PSK for TLS.
> 
> Signed-off-by: Hannes Reinecke <hare@suse.de>
> ---
>   drivers/nvme/common/keyring.c | 47 +++++++++++++++++++++++++++++++++++
>   include/linux/nvme-keyring.h  |  2 ++
>   2 files changed, 49 insertions(+)
> 
> diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c
> index 4ac33538f839..ca36a061bd48 100644
> --- a/drivers/nvme/common/keyring.c
> +++ b/drivers/nvme/common/keyring.c
> @@ -103,6 +103,53 @@ struct key *nvme_tls_psk_lookup(struct key *keyring,
>   }
>   EXPORT_SYMBOL_GPL(nvme_tls_psk_lookup);
>   
> +/*
> + * NVMe PSK priority list
> + *
> + * 'Retained' PSKs (ie 'generated == false')
> + * should be preferred to 'generated' PSKs,
> + * and SHA-384 should be preferred to SHA-256.
> + */
> +struct nvme_psk_priority_list {

nvme_tls_psk_priority_list

> +	bool generated;
> +	enum nvme_tcp_tls_cipher cipher;
> +} nvme_psk_prio[] = {

nvme_tls_psk_prio

> +	{ .generated = false,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
> +	{ .generated = false,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
> +	{ .generated = true,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
> +	{ .generated = true,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
> +};
> +
> +/*
> + * nvme_tls_psk_default - Return 'best' PSK to use for TLS ClientHello

s/'best'/the preferred/...