Commit 1a70200f authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Jens Axboe
Browse files

nvmet-auth: expire authentication sessions 



Each authentication step is required to be completed within the
KATO interval (or two minutes if not set). So add a workqueue function
to reset the transaction ID and the expected next protocol step;
this will automatically the next authentication command referring
to the terminated authentication.

Signed-off-by: default avatarHannes Reinecke <hare@suse.de>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 7a277c37

drivers/nvme/target/auth.c

+1 −0
Original line number Diff line number Diff line
@@ -218,6 +218,7 @@ int nvmet_setup_auth(struct nvmet_ctrl *ctrl) 


void nvmet_auth_sq_free(struct nvmet_sq *sq)

{

	cancel_delayed_work(&sq->auth_expired_work);

	kfree(sq->dhchap_c1);

	sq->dhchap_c1 = NULL;

	kfree(sq->dhchap_c2);

drivers/nvme/target/fabrics-cmd-auth.c

+19 −1
Original line number Diff line number Diff line
@@ -12,11 +12,24 @@ 
#include <crypto/kpp.h>

#include "nvmet.h"



static void nvmet_auth_expired_work(struct work_struct *work)

{

	struct nvmet_sq *sq = container_of(to_delayed_work(work),

			struct nvmet_sq, auth_expired_work);



	pr_debug("%s: ctrl %d qid %d transaction %u expired, resetting\n",

		 __func__, sq->ctrl->cntlid, sq->qid, sq->dhchap_tid);

	sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;

	sq->dhchap_tid = -1;

}



void nvmet_init_auth(struct nvmet_ctrl *ctrl, struct nvmet_req *req)

{

	u32 result = le32_to_cpu(req->cqe->result.u32);



	/* Initialize in-band authentication */

	INIT_DELAYED_WORK(&req->sq->auth_expired_work,

			  nvmet_auth_expired_work);

	req->sq->authenticated = false;

	req->sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_NEGOTIATE;

	result |= (u32)NVME_CONNECT_AUTHREQ_ATR << 16;
@@ -333,8 +346,13 @@ void nvmet_execute_auth_send(struct nvmet_req *req) 
	req->cqe->result.u64 = 0;

	nvmet_req_complete(req, status);

	if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&

	    req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)

	    req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {

		unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;



		mod_delayed_work(system_wq, &req->sq->auth_expired_work,

				 auth_expire_secs * HZ);

		return;

	}

	/* Final states, clear up variables */

	nvmet_auth_sq_free(req->sq);

	if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)

drivers/nvme/target/nvmet.h

+1 −0
Original line number Diff line number Diff line
@@ -109,6 +109,7 @@ struct nvmet_sq { 
	u32			sqhd;

	bool			sqhd_disabled;

#ifdef CONFIG_NVME_TARGET_AUTH

	struct delayed_work	auth_expired_work;

	bool			authenticated;

	u16			dhchap_tid;

	u16			dhchap_status;