Commit aabfea70 authored by Krzysztof Karas's avatar Krzysztof Karas Committed by Jim Harris
Browse files

nvmf: implement get_key() in tcp transport 



Add get_key() implementation to tcp transport to retrieve
PSK based on client's identity.
`cipher` will remain NULL until cipher suite
handling is introduced. This field will be used to
retrieve cipher name to be used by SSL handshake.

nvmf_tcp_listen() now adds get_key() callback to sock opts, if
default implementation is set to "ssl".

Change-Id: I89cd5046d69f926a20c7a9c852757f5625d6a617
Signed-off-by: default avatarKrzysztof Karas <krzysztof.karas@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/15549


Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarBen Walker <benjamin.walker@intel.com>
parent 3e98fd06

lib/nvmf/tcp.c

+32 −0
Original line number Diff line number Diff line
@@ -809,6 +809,36 @@ nvmf_tcp_find_port(struct spdk_nvmf_tcp_transport *ttransport, 
	return NULL;

}



static int

tcp_sock_get_key(uint8_t *out, int out_len, const char **cipher, const char *psk_identity,

		 void *get_key_ctx)

{

	struct tcp_psk_entry *entry;

	struct spdk_nvmf_tcp_transport *ttransport = get_key_ctx;

	size_t psk_len;



	*cipher = NULL;



	TAILQ_FOREACH(entry, &ttransport->psks, link) {

		if (strcmp(psk_identity, entry->psk_identity) != 0) {

			continue;

		}



		psk_len = strlen(entry->psk);

		if ((size_t)out_len <= psk_len) {

			SPDK_ERRLOG("Out buffer of size: %" PRIu32 " cannot fit PSK of len: %lu\n",

				    out_len, psk_len);

			return -ENOBUFS;

		}

		memcpy(out, entry->psk, psk_len + 1);

		return psk_len;

	}



	SPDK_ERRLOG("Could not find PSK for identity: %s\n", psk_identity);



	return -EINVAL;

}



static int

nvmf_tcp_listen(struct spdk_nvmf_transport *transport, const struct spdk_nvme_transport_id *trid,

		struct spdk_nvmf_listen_opts *listen_opts)
@@ -852,6 +882,8 @@ nvmf_tcp_listen(struct spdk_nvmf_transport *transport, const struct spdk_nvme_tr 
		sock_impl_name = "ssl";

		spdk_sock_impl_get_opts(sock_impl_name, &impl_opts, &impl_opts_size);

		impl_opts.tls_version = SPDK_TLS_VERSION_1_3;

		impl_opts.get_key = tcp_sock_get_key;

		impl_opts.get_key_ctx = ttransport;

		opts.impl_opts = &impl_opts;

		opts.impl_opts_size = sizeof(impl_opts);

	}

test/nvmf/target/tls.sh

+4 −33
Original line number Diff line number Diff line
@@ -75,46 +75,17 @@ if [[ "$ktls" != "false" ]]; then 
	exit 1

fi



# Check default PSK key

key=$($rpc_py sock_impl_get_options -i ssl | jq -r .psk_key)

if [[ "$key" != "null" ]]; then

	echo "TLS default key should be empty and not $key"

	exit 1

fi



# Check default PSK key set

$rpc_py sock_impl_set_options -i ssl --psk-key 1234567890ABCDEF

key=$($rpc_py sock_impl_get_options -i ssl | jq -r .psk_key)

if [[ "$key" != "1234567890ABCDEF" ]]; then

	echo "TLS key was not set correctly $key != 1234567890ABCDEF"

	exit 1

fi



# Check default PSK identity

identity=$($rpc_py sock_impl_get_options -i ssl | jq -r .psk_identity)

if [[ "$identity" != "null" ]]; then

	echo "TLS default identity should be empty and not $identity"

	exit 1

fi



# Check default PSK identity set

$rpc_py sock_impl_set_options -i ssl --psk-identity \

	"NVMe0R01 nqn.2016-06.io.spdk:host1 nqn.2016-06.io.spdk:cnode1"

identity=$($rpc_py sock_impl_get_options -i ssl | jq -r .psk_identity)

if [[ "$identity" != "NVMe0R01 nqn.2016-06.io.spdk:host1 nqn.2016-06.io.spdk:cnode1" ]]; then

	echo "PSK ID was not set correctly $identity != NVMe0R01 nqn.2016-06.io.spdk:host1 nqn.2016-06.io.spdk:cnode1"

	exit 1

fi



$rpc_py sock_impl_set_options -i ssl --tls-version 13

$rpc_py framework_start_init

$rpc_py nvmf_create_transport $NVMF_TRANSPORT_OPTS

$rpc_py nvmf_create_subsystem nqn.2016-06.io.spdk:cnode1 -a -s SPDK00000000000001 -m 10

$rpc_py nvmf_create_subsystem nqn.2016-06.io.spdk:cnode1 -s SPDK00000000000001 -m 10

$rpc_py nvmf_subsystem_add_listener nqn.2016-06.io.spdk:cnode1 -t $TEST_TRANSPORT \

	-a $NVMF_FIRST_TARGET_IP -s $NVMF_PORT

	-a $NVMF_FIRST_TARGET_IP -s $NVMF_PORT -k

$rpc_py bdev_malloc_create 32 4096 -b malloc0

$rpc_py nvmf_subsystem_add_ns nqn.2016-06.io.spdk:cnode1 malloc0 -n 1



$rpc_py nvmf_subsystem_add_host nqn.2016-06.io.spdk:cnode1 nqn.2016-06.io.spdk:host1 --psk 1234567890ABCDEF



# Send IO

"${NVMF_TARGET_NS_CMD[@]}" $SPDK_EXAMPLE_DIR/perf -S ssl -q 64 -o 4096 -w randrw -M 30 -t 10 \

	-r "trtype:${TEST_TRANSPORT} adrfam:IPv4 traddr:${NVMF_FIRST_TARGET_IP} trsvcid:${NVMF_PORT} \

test/unit/lib/nvmf/tcp.c/tcp_ut.c

+2 −0
Original line number Diff line number Diff line
@@ -238,6 +238,8 @@ DEFINE_STUB(spdk_bdev_get_zone_size, uint64_t, (const struct spdk_bdev *bdev), 0 
DEFINE_STUB(spdk_nvme_ns_get_format_index, uint32_t,

	    (const struct spdk_nvme_ns_data *nsdata), 0);



DEFINE_STUB(spdk_sock_get_default_impl_name, const char *, (void), "");



struct spdk_io_channel *

spdk_accel_get_io_channel(void)

{