Commit 53ba4f62 authored by Konrad Sztyber's avatar Konrad Sztyber Committed by Tomasz Zawadzki
Browse files

nvmf: add in-band authentication definitions 



Signed-off-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I9392bbb19d1c4a65312fcbb0814987c29a6ab300
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21980


Reviewed-by: default avatarJim Harris <jim.harris@samsung.com>
Community-CI: Mellanox Build Bot
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarBen Walker <ben@nvidia.com>
parent 592e7435

include/spdk/nvmf_spec.h

+151 −1
Original line number Diff line number Diff line
@@ -223,7 +223,12 @@ struct spdk_nvmf_fabric_connect_rsp { 
	union {

		struct {

			uint16_t cntlid;

			uint16_t authreq;

			struct {

				uint16_t reserved1	: 1;

				uint16_t atr		: 1;

				uint16_t ascr		: 1;

				uint16_t reserved2	: 13;

			} authreq;

		} success;



		struct {
@@ -434,6 +439,151 @@ struct spdk_nvmf_discovery_log_page { 
};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_discovery_log_page) == 1024, "Incorrect size");



/** Security protocol identifier assigned to NVMe */

#define SPDK_NVMF_AUTH_SECP_NVME 0xe9



/** Authentication types */

enum spdk_nvmf_auth_type {

	SPDK_NVMF_AUTH_TYPE_COMMON_MESSAGE	= 0x0,

	SPDK_NVMF_AUTH_TYPE_DHCHAP		= 0x1,

};



/** AUTH message identifiers */

enum spdk_nvmf_auth_id {

	SPDK_NVMF_AUTH_ID_NEGOTIATE		= 0x00,

	SPDK_NVMF_AUTH_ID_DHCHAP_CHALLENGE	= 0x01,

	SPDK_NVMF_AUTH_ID_DHCHAP_REPLY		= 0x02,

	SPDK_NVMF_AUTH_ID_DHCHAP_SUCCESS1	= 0x03,

	SPDK_NVMF_AUTH_ID_DHCHAP_SUCCESS2	= 0x04,

	SPDK_NVMF_AUTH_ID_FAILURE2		= 0xf0,

	SPDK_NVMF_AUTH_ID_FAILURE1		= 0xf1,

};



/** Hash function identifiers */

enum spdk_nvmf_dhchap_hash {

	SPDK_NVMF_DHCHAP_HASH_NONE	= 0x0,

	SPDK_NVMF_DHCHAP_HASH_SHA256	= 0x1,

	SPDK_NVMF_DHCHAP_HASH_SHA384	= 0x2,

	SPDK_NVMF_DHCHAP_HASH_SHA512	= 0x3,

};



/** Diffie-Hellman group identifiers */

enum spdk_nvmf_dhchap_dhgroup {

	SPDK_NVMF_DHCHAP_DHGROUP_NULL = 0x0,

	SPDK_NVMF_DHCHAP_DHGROUP_2048 = 0x1,

	SPDK_NVMF_DHCHAP_DHGROUP_3072 = 0x2,

	SPDK_NVMF_DHCHAP_DHGROUP_4096 = 0x3,

	SPDK_NVMF_DHCHAP_DHGROUP_6144 = 0x4,

	SPDK_NVMF_DHCHAP_DHGROUP_8192 = 0x5,

};



struct spdk_nvmf_auth_descriptor {

	uint8_t		auth_id;

	uint8_t		reserved0;

	uint8_t		halen;

	uint8_t		dhlen;

	uint8_t		hash_id_list[30];

	uint8_t		dhg_id_list[30];

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_auth_descriptor) == 64, "Incorrect size");



/** Secure channel concatenation */

enum spdk_nvmf_auth_scc {

	/** No secure channel concatenation */

	SPDK_NVMF_AUTH_SCC_DISABLED	= 0,

	/** Secure channel concatenation with TLS (TCP) */

	SPDK_NVMF_AUTH_SCC_TLS		= 1,

};



struct spdk_nvmf_auth_negotiate {

	uint8_t					auth_type;

	uint8_t					auth_id;

	uint8_t					reserved0[2];

	uint16_t				t_id;

	uint8_t					sc_c;

	uint8_t					napd;

	struct spdk_nvmf_auth_descriptor	descriptors[0];

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_auth_negotiate) == 8, "Incorrect size");



struct spdk_nvmf_dhchap_challenge {

	uint8_t		auth_type;

	uint8_t		auth_id;

	uint8_t		reserved0[2];

	uint16_t	t_id;

	uint8_t		hl;

	uint8_t		reserved1;

	uint8_t		hash_id;

	uint8_t		dhg_id;

	uint16_t	dhvlen;

	uint32_t	seqnum;

	uint8_t		cval[0];

	/* Followed by optional dhv if dhvlen > 0 */

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_dhchap_challenge) == 16, "Incorrect size");



struct spdk_nvmf_dhchap_reply {

	uint8_t		auth_type;

	uint8_t		auth_id;

	uint8_t		reserved0[2];

	uint16_t	t_id;

	uint8_t		hl;

	uint8_t		reserved1;

	uint8_t		cvalid;

	uint8_t		reserved2;

	uint16_t	dhvlen;

	uint32_t	seqnum;

	uint8_t		rval[0];

	/* Followed by cval[hl] and dhv[dhvlen] */

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_dhchap_reply) == 16, "Incorrect size");



struct spdk_nvmf_dhchap_success1 {

	uint8_t		auth_type;

	uint8_t		auth_id;

	uint8_t		reserved0[2];

	uint16_t	t_id;

	uint8_t		hl;

	uint8_t		reserved1;

	uint8_t		rvalid;

	uint8_t		reserved2[7];

	uint8_t		rval[0];

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_dhchap_success1) == 16, "Incorrect size");



struct spdk_nvmf_dhchap_success2 {

	uint8_t		auth_type;

	uint8_t		auth_id;

	uint8_t		reserved0[2];

	uint16_t	t_id;

	uint8_t		reserved1[10];

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_dhchap_success2) == 16, "Incorrect size");



/** AUTH_Failure reason codes */

#define SPDK_NVMF_AUTH_FAILURE 1



/** AUTH_Failure reason code explanations */

enum spdk_nvmf_auth_failure_reason {

	SPDK_NVMF_AUTH_FAILED				= 0x1,

	SPDK_NVMF_AUTH_PROTOCOL_UNUSABLE		= 0x2,

	SPDK_NVMF_AUTH_SCC_MISMATCH			= 0x3,

	SPDK_NVMF_AUTH_HASH_UNUSABLE			= 0x4,

	SPDK_NVMF_AUTH_DHGROUP_UNUSABLE			= 0x5,

	SPDK_NVMF_AUTH_INCORRECT_PAYLOAD		= 0x6,

	SPDK_NVMF_AUTH_INCORRECT_PROTOCOL_MESSAGE	= 0x7,

};



struct spdk_nvmf_auth_failure {

	uint8_t		auth_type;

	uint8_t		auth_id;

	uint8_t		reserved0[2];

	uint16_t	t_id;

	uint8_t		rc;

	uint8_t		rce;

};

SPDK_STATIC_ASSERT(sizeof(struct spdk_nvmf_auth_failure) == 8, "Incorrect size");



/* RDMA Fabric specific definitions below */



#define SPDK_NVME_SGL_SUBTYPE_INVALIDATE_KEY	0xF