bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 06:44:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

nvmet-tcp: peek icreq before starting TLS

Browse Source 
Incoming connection might be either 'normal' NVMe-TCP connections
starting with icreq or TLS handshakes. To ensure that 'normal'
connections can still be handled we need to peek the first packet
and only start TLS handshake if it's not an icreq.
With that we can lift the restriction to always set TREQ to
'required' when TLS1.3 is enabled.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
This commit is contained in:
Hannes Reinecke
2023-08-24 16:39:25 +02:00
committed by Keith Busch
parent a1c5dd8355
commit 70525e5d82
3 changed files with 82 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/nvme/target/configfs.c
View File

@@ -198,6 +198,20 @@ static ssize_t nvmet_addr_treq_store(struct config_item *item,
return -EINVAL;
found:
if (port->disc_addr.trtype == NVMF_TRTYPE_TCP &&
port->disc_addr.tsas.tcp.sectype == NVMF_TCP_SECTYPE_TLS13) {
switch (nvmet_addr_treq[i].type) {
case NVMF_TREQ_NOT_SPECIFIED:
pr_debug("treq '%s' not allowed for TLS1.3\n",
nvmet_addr_treq[i].name);
return -EINVAL;
case NVMF_TREQ_NOT_REQUIRED:
pr_warn("Allow non-TLS connections while TLS1.3 is enabled\n");
break;
default:
break;
}
}
treq |= nvmet_addr_treq[i].type;
port->disc_addr.treq = treq;
return count;
@@ -410,12 +424,15 @@ found:
nvmet_port_init_tsas_tcp(port, sectype);
/*
* The TLS implementation currently does not support
* secure concatenation, so TREQ is always set to 'required'
* if TLS is enabled.
* If TLS is enabled TREQ should be set to 'required' per default
*/
if (sectype == NVMF_TCP_SECTYPE_TLS13) {
treq |= NVMF_TREQ_REQUIRED;
u8 sc = nvmet_port_disc_addr_treq_secure_channel(port);
if (sc == NVMF_TREQ_NOT_SPECIFIED)
treq |= NVMF_TREQ_REQUIRED;
else
treq |= sc;
} else {
treq |= NVMF_TREQ_NOT_SPECIFIED;
}