Commit 4becb0d1 authored by Boris Glimcher's avatar Boris Glimcher Committed by Jim Harris
Browse files

nvmf/tcp: Allow to choose SSL socket implementation 



Adding `secure_channel` parameter to `nvmf_subsystem_add_listener` RPC

Change-Id: Ia0e13dd45add755d3851cb1897706c9fbca7a3b9
Signed-off-by: default avatarBoris Glimcher <Boris.Glimcher@emc.com>
Signed-off-by: default avatarKrzysztof Karas <krzysztof.karas@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/15095


Reviewed-by: default avatarAleksey Marchuk <alexeymar@nvidia.com>
Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Community-CI: Mellanox Build Bot
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Reviewed-by: default avatarBen Walker <benjamin.walker@intel.com>
parent 25ea6527

CHANGELOG.md

+4 −0
Original line number Diff line number Diff line
@@ -57,6 +57,10 @@ Two functions related to Asynchronous Event and error handling have been made pu 
Parameters `cb_fn` and `ctx` of `spdk_nvmf_qpair_disconnect` API are deprecated. These parameters

will be removed in 23.09 release.



Added a secure_channel parameter to the nvmf_subsystem_add_listener RPC. When true, all connections

established via this listener will immediately attempt to establish a secure channel, prior to any

authentication. Only valid for the TCP transport.



### nvme



New API `spdk_nvme_ns_get_format_index` was added to calculate the exact format index, that

doc/jsonrpc.md

+1 −0
Original line number Diff line number Diff line
@@ -7893,6 +7893,7 @@ Name | Optional | Type | Description 
nqn                     | Required | string      | Subsystem NQN

tgt_name                | Optional | string      | Parent NVMe-oF target name.

listen_address          | Required | object      | @ref rpc_nvmf_listen_address object

secure_channel          | Optional | bool        | Whether all connections immediately attempt to establish a secure channel



#### listen_address {#rpc_nvmf_listen_address}

include/spdk/nvmf.h

+8 −1
Original line number Diff line number Diff line
@@ -107,8 +107,15 @@ struct spdk_nvmf_listen_opts { 
	size_t opts_size;



	const struct spdk_json_val *transport_specific;



	/**

	 * Indicates that all newly established connections shall immediately

	 * establish a secure channel, prior to any authentication.

	 */

	bool secure_channel;



} __attribute__((packed));

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_listen_opts) == 16, "Incorrect size");

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_listen_opts) == 17, "Incorrect size");



/**

 * Initialize listen options

lib/nvmf/nvmf.c

+2 −1
Original line number Diff line number Diff line
@@ -636,11 +636,12 @@ nvmf_listen_opts_copy(struct spdk_nvmf_listen_opts *opts, 
    } \



	SET_FIELD(transport_specific);

	SET_FIELD(secure_channel);

#undef SET_FIELD



	/* Do not remove this statement, you should always update this statement when you adding a new field,

	 * and do not forget to add the SET_FIELD statement for your added field. */

	SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_listen_opts) == 16, "Incorrect size");

	SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_listen_opts) == 17, "Incorrect size");

}



void

lib/nvmf/nvmf_rpc.c

+9 −0
Original line number Diff line number Diff line
@@ -622,6 +622,7 @@ enum nvmf_rpc_listen_op { 
struct nvmf_rpc_listener_ctx {

	char				*nqn;

	char				*tgt_name;

	bool				secure_channel;

	struct spdk_nvmf_tgt		*tgt;

	struct spdk_nvmf_transport	*transport;

	struct spdk_nvmf_subsystem	*subsystem;
@@ -641,6 +642,7 @@ static const struct spdk_json_object_decoder nvmf_rpc_listener_decoder[] = { 
	{"nqn", offsetof(struct nvmf_rpc_listener_ctx, nqn), spdk_json_decode_string},

	{"listen_address", offsetof(struct nvmf_rpc_listener_ctx, address), decode_rpc_listen_address},

	{"tgt_name", offsetof(struct nvmf_rpc_listener_ctx, tgt_name), spdk_json_decode_string, true},

	{"secure_channel", offsetof(struct nvmf_rpc_listener_ctx, secure_channel), spdk_json_decode_bool, true},

};



static void
@@ -893,6 +895,13 @@ rpc_nvmf_subsystem_add_listener(struct spdk_jsonrpc_request *request, 
	ctx->op = NVMF_RPC_LISTEN_ADD;

	spdk_nvmf_listen_opts_init(&ctx->opts, sizeof(ctx->opts));

	ctx->opts.transport_specific = params;

	if (subsystem->flags.allow_any_host == 1 && ctx->secure_channel == true) {

		spdk_jsonrpc_send_error_response(request, SPDK_JSONRPC_ERROR_INTERNAL_ERROR,

						 "Cannot establish secure channel, when 'allow_any_host' is set");

		nvmf_rpc_listener_ctx_free(ctx);

		return;

	}

	ctx->opts.secure_channel = ctx->secure_channel;



	rc = spdk_nvmf_subsystem_pause(subsystem, 0, nvmf_rpc_listen_paused, ctx);

	if (rc != 0) {