> On Sep 28, 2021, at 1:03 AM, Hannes Reinecke <hare@xxxxxxx> wrote: > > Hi all, > > recent updates to the NVMe spec have added definitions for in-band > authentication, and seeing that it provides some real benefit > especially for NVMe-TCP here's an attempt to implement it. > > Tricky bit here is that the specification orients itself on TLS 1.3, > but supports only the FFDHE groups. Which of course the kernel doesn't > support. I've been able to come up with a patch for this, but as this > is my first attempt to fix anything in the crypto area I would invite > people more familiar with these matters to have a look. > > Also note that this is just for in-band authentication. Secure > concatenation (ie starting TLS with the negotiated parameters) is not > implemented; one would need to update the kernel TLS implementation > for this, which at this time is beyond scope. > > As usual, comments and reviews are welcome. > > Changes to v3: > - Renamed parameter to 'dhchap_ctrl_key' > - Fixed bi-directional authentication > - Included reviews from Sagi > - Fixed base64 algorithm for transport encoding > > Changes to v2: > - Dropped non-standard algorithms > - Reworked base64 based on fs/crypto/fname.c > - Fixup crash with no keys > > Changes to the original submission: > - Included reviews from Vladislav > - Included reviews from Sagi > - Implemented re-authentication support > - Fixed up key handling > > Hannes Reinecke (12): > crypto: add crypto_has_shash() > crypto: add crypto_has_kpp() > crypto/ffdhe: Finite Field DH Ephemeral Parameters > lib/base64: RFC4648-compliant base64 encoding > nvme: add definitions for NVMe In-Band authentication > nvme-fabrics: decode 'authentication required' connect error > nvme: Implement In-Band authentication > nvme-auth: Diffie-Hellman key exchange support > nvmet: Parse fabrics commands on all queues > nvmet: Implement basic In-Band Authentication > nvmet-auth: Diffie-Hellman key exchange support > nvmet-auth: expire authentication sessions > > crypto/Kconfig | 8 + > crypto/Makefile | 1 + > crypto/ffdhe_helper.c | 880 ++++++++++++++ > crypto/kpp.c | 6 + > crypto/shash.c | 6 + > drivers/nvme/host/Kconfig | 12 + > drivers/nvme/host/Makefile | 1 + > drivers/nvme/host/auth.c | 1501 ++++++++++++++++++++++++ > drivers/nvme/host/auth.h | 33 + > drivers/nvme/host/core.c | 126 +- > drivers/nvme/host/fabrics.c | 85 +- > drivers/nvme/host/fabrics.h | 7 + > drivers/nvme/host/nvme.h | 33 + > drivers/nvme/host/trace.c | 32 + > drivers/nvme/target/Kconfig | 12 + > drivers/nvme/target/Makefile | 1 + > drivers/nvme/target/admin-cmd.c | 4 + > drivers/nvme/target/auth.c | 486 ++++++++ > drivers/nvme/target/configfs.c | 133 ++- > drivers/nvme/target/core.c | 10 + > drivers/nvme/target/fabrics-cmd-auth.c | 507 ++++++++ > drivers/nvme/target/fabrics-cmd.c | 30 +- > drivers/nvme/target/nvmet.h | 74 ++ > include/crypto/ffdhe.h | 24 + > include/crypto/hash.h | 2 + > include/crypto/kpp.h | 2 + > include/linux/base64.h | 16 + > include/linux/nvme.h | 186 ++- > lib/Makefile | 2 +- > lib/base64.c | 100 ++ > 30 files changed, 4309 insertions(+), 11 deletions(-) > create mode 100644 crypto/ffdhe_helper.c > create mode 100644 drivers/nvme/host/auth.c > create mode 100644 drivers/nvme/host/auth.h > create mode 100644 drivers/nvme/target/auth.c > create mode 100644 drivers/nvme/target/fabrics-cmd-auth.c > create mode 100644 include/crypto/ffdhe.h > create mode 100644 include/linux/base64.h > create mode 100644 lib/base64.c > > -- > 2.29.2 > > > _______________________________________________ > Linux-nvme mailing list > Linux-nvme@xxxxxxxxxxxxxxxxxxx > http://lists.infradead.org/mailman/listinfo/linux-nvme I reviewed patches 1-7 using b4 to apply on my local tree, because I am not able to locate them in my mailbox and lack of versioning on each patch makes it hard to figure out which one belong to which revision. Please add for v4 patches 1 - 7 Reviewed-by: Himanshu Madhani <himanshu.madhani@xxxxxxxxxx> -- Himanshu Madhani Oracle Linux Engineering
