Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NVMe-TCP TLS encryption #147

Open
wants to merge 33 commits into
base: master
Choose a base branch
from
Open

NVMe-TCP TLS encryption #147

wants to merge 33 commits into from

Commits on Oct 9, 2024

  1. nvme/038: use nvme_trtype instead of hardcoding

    There is no reason why loop is required, so switch to the default
    transport type.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    78b7506 View commit details
    Browse the repository at this point in the history
  2. nvme: make trtype argument to _create_nvmet_port() optional

    All invocations are using 'nvme_trtype' as argument to
    _create_nvmet_ports(), so we can also make it optional and default
    to nvme_trtype.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    5b35c28 View commit details
    Browse the repository at this point in the history
  3. nvme: sanitize transport parameter in _create_nvmet_port()

    We need to sanitize the transport parameters in _create_nvmet_port()
    to avoid having invalid transport values when selecting a transport
    type.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    77fdd21 View commit details
    Browse the repository at this point in the history
  4. nvme: return error from _find_nvme_ns()

    When _find_nvme_ns() fails it should return a non-zero statue to allow for
    the error to be propagated to the caller.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    7a1f281 View commit details
    Browse the repository at this point in the history
  5. nvme: simplify _get_nvmet_ports()

    Rework the loop to iterate over ports, and check for the correct
    subsysnqn afterwards. With that we can drop 'sed' calls and simplify
    the loop.
    
    Signed-off-by: Hannes Reinecke <[email protected].
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    75c68a0 View commit details
    Browse the repository at this point in the history
  6. nvme: check for controller device in _nvme_connect_subsys()

    When calling 'nvme connect' we cannot assume that a namespace is
    always present (eg if connecting to a discovery service), so better
    check for the controller device to ensure that 'nvme connect' has
    succeeded.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    c5c1348 View commit details
    Browse the repository at this point in the history
  7. nvme: pass in port parameter to _nvme_connect_subsys()

    A subsystem might have more than one port, and that port might be
    configured differently from the default settings. So rather than
    to rely on the default settings we should extract the parameters
    from the passed in ports on that subsystem and issue 'nvme connect'
    with the extracted parameters.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    1bfeee1 View commit details
    Browse the repository at this point in the history
  8. common/nvme, nvme/{rc,054}: remove "local -n" from _get_nvmet_ports()

    The -n option of the bash local variable declaration declares that
    the variable is used as nameref. However, this nameref feature was
    introduced to bash at its version 4.3. While blktests requires bash
    version 4.2. To not rely on the bash version 4.3, replace the nameref
    feature with a loop to parse arguments.
    
    Signed-off-by: Shin'ichiro Kawasaki <[email protected]>
    kawasaki authored and hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    1994b24 View commit details
    Browse the repository at this point in the history
  9. nvme: delete all namespaces in _remove_nvmet_subsystem()

    A subsystem might have more than one namespace, so delete all of
    them in _remove_nvmet_subsystem().
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    dd65b11 View commit details
    Browse the repository at this point in the history
  10. nvme: support only long options for _create_nvmet_ns()

    Support only long options for _create_nvmet_ns() to simplify calling
    sequence and allow to pass in an options ANA group id.
    If no UUID is passed the kernel will generate a UUID, so return
    the UUID to allow the caller to identify the generated namespace.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 9, 2024
    Configuration menu
    Copy the full SHA
    46669ad View commit details
    Browse the repository at this point in the history

Commits on Oct 11, 2024

  1. nvme: support only long options for _create_nvmet_subsystem()

    Most callers use the default settings anyway, so simplify them
    by using long options for _create_nvmet_subsystem().
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    a2162e7 View commit details
    Browse the repository at this point in the history
  2. nvme/rc: Implement --blkdev none for _nvmet_target_setup()

    Add an option '--blkdev none' for _nvmet_target_setup() to indicate
    that no block devices (and no namespaces) should be created when
    setting up the target.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    88e67d0 View commit details
    Browse the repository at this point in the history
  3. nvme: move _nvmet_target_setup() to common/nvme

    _nvmet_target_setup() is in tests/nvme/rc, but _nvmet_target_cleanup()
    is in common/nvme. So move the former into common/nvme to have both
    functions in the same place.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    7d0069f View commit details
    Browse the repository at this point in the history
  4. nvme/016: do not create namespace when setting up the target

    Simplify the testcase by not creating a namespace when setting up
    the target and have to loop iterating over all namespaces.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    4cef26a View commit details
    Browse the repository at this point in the history
  5. nvme/017: do not create namespace when setting up the target

    Simplify the testcase by not creating a namespace when setting up
    the target and have to loop iterating over all namespaces.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    48c8518 View commit details
    Browse the repository at this point in the history
  6. nvme/052: do not create namespace when setting up the target

    Simplify the testcase by not creating a namespace when setting up
    the target and have to loop iterating over all namespaces.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    89c5bf6 View commit details
    Browse the repository at this point in the history
  7. nvme/003: open-code _nvmet_setup

    Most of the steps in _nvmet_setup() are not required here, and doesn't
    work with discovery connections. So open-code it to avoid the pitfalls
    and make the test simpler.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    8aa02ae View commit details
    Browse the repository at this point in the history
  8. nvme/031: open-code helper functions

    The default helper functions are doing quite some things which are unneccesary for
    this test, so open-code them to call just the required functions.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    e9aabff View commit details
    Browse the repository at this point in the history
  9. nvme: rework fcloop

    Rework fcloop handling to create only one local port but several
    remote ports. That way we can keep the global setting for local port
    addresses and don't need to worry about passing the correct local
    port address when calling 'nvme connect'.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    5545881 View commit details
    Browse the repository at this point in the history
  10. nvme: drop arguments from _create_nvmet_port()

    Always called without arguments, so drop the assignment.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    5f889bb View commit details
    Browse the repository at this point in the history
  11. nvme: add _setup_nvmet_port_ana()

    Add a function to set the ANA state and group id for a port.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    6685f89 View commit details
    Browse the repository at this point in the history
  12. nvme: add _setup_nvmet_ns_ana()

    Add a function to set the ANA groupid for a namespace.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    e0ad900 View commit details
    Browse the repository at this point in the history
  13. nvme/rc: add argument '--ports' to _nvmet_target_setup()

    Add an argument '--ports' to _nvmet_target_setup() to specify the
    number of ports to create.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    8d7cd69 View commit details
    Browse the repository at this point in the history
  14. nvme: delete all ana_groups when removing a port

    A port might have several ANA groups, and we have to remove all
    ANA groups with a group id other than 1, otherwise we cannot
    remove the port itself.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    9f949ba View commit details
    Browse the repository at this point in the history
  15. test/nvme: add test for basic ANA support

    Add a test for basic ANA support by creating 4 paths, run a fio
    process to generate load, and then switch port states to check
    if I/O continues uninterrupted.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    a3f7272 View commit details
    Browse the repository at this point in the history
  16. test/nvme: add test for rapid namespace remapping

    Add a test for rapid namespace remapping to simulate short-lived
    namespaces being created and deleted in rapid succession with a
    cluster.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    5ad1068 View commit details
    Browse the repository at this point in the history
  17. nvme: make argument to _find_nvme_dev() optional

    Most callers use the default subsystem NQN as argument to
    _find_nvme_ns(), so make it optional.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    9dff04f View commit details
    Browse the repository at this point in the history
  18. nvme: add _require_trtype_is_tcp()

    Add a function to restrict testcases to TCP transport.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    aa78c99 View commit details
    Browse the repository at this point in the history
  19. nvme: add '--tls' argument to _nvme_connect_subsys()

    To start TLS-encrypted connections.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    dd018ac View commit details
    Browse the repository at this point in the history
  20. nvme: TLS target support

    Add --tls option to _create_nvmet_subsystem and allow to specify
    the tls requirements in _create_nvmet_port.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    c212669 View commit details
    Browse the repository at this point in the history
  21. nvme: add testcase for TLS-encrypted connections

    TCP connections can be encrypted using in-kernel TLS, so add a
    testcase to exercise the various combinations.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    340eeba View commit details
    Browse the repository at this point in the history
  22. nvme: handle option '--concat' for _nvme_connect_subsys

    To start secure concatenation the option '--concat' has to be passed
    to the 'nvme connect' command.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    b43073e View commit details
    Browse the repository at this point in the history
  23. nvme: add test for secure concatenation

    Add testcase for secure concatenation on NVMe-over-TCP.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    hreinecke committed Oct 11, 2024
    Configuration menu
    Copy the full SHA
    4279485 View commit details
    Browse the repository at this point in the history