nvme: Use libnvme for generating DH-HMAC-CHAP host keys

libnvme learned to generate the keyes. Use it. With this we can also
drop the dependency on OpenSSL.

Signed-off-by: Daniel Wagner <dwagner@suse.de>

diff --git a/meson.build b/meson.build
index 6caaf2aaaa1cb6cdcc738a3e4fab079ec5055575..7c0217dc34c66421248dd1566f5753b2e73a2430 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -57,12 +57,6 @@ conf.set('CONFIG_LIBHUGETLBFS', have_libhugetlbfs, description: 'Is libhugetlbfs
 # Check for zlib availability
 libz_dep = dependency('zlib', fallback : ['zlib', 'zlib_dep'])
 
-# Check for OpenSSL availability
-openssl_dep = dependency('openssl', version: '>=1.1.0',
-                         required: get_option('openssl'),
-                         fallback : ['openssl', 'openssl_dep'])
-conf.set('CONFIG_OPENSSL', openssl_dep.found(), description: 'Is OpenSSL available?')
-
 # Set the nvme-cli version
 conf.set('NVME_VERSION', '"' + meson.project_version() + '"')
 
@@ -194,7 +188,7 @@ subdir('Documentation')
 executable(
   'nvme',
   sources,
-  dependencies: [ libnvme_dep, libuuid_dep, json_c_dep, libz_dep, openssl_dep,
+  dependencies: [ libnvme_dep, libuuid_dep, json_c_dep, libz_dep,
                   libhugetlbfs_dep ],
   include_directories: incdir,
   install: true,

diff --git a/meson_options.txt b/meson_options.txt
index 864b1e1c2de4f8fbc46b87f8680c8a070845f05f..6fdc681792ffedce66d7216e657c0a4d773b8bc0 100644 (file)
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -4,4 +4,3 @@ option('systemddir', type : 'string', value : 'lib/systemd/', description : 'dir
 option('htmldir', type : 'string', value : '', description : 'directory for HTML documentation')
 
 option('docs', type : 'combo', choices : ['false', 'html', 'man', 'all'], description : 'install documentation')
-option('openssl', type : 'feature', value: 'auto', description : 'OpenSSL support')

diff --git a/nvme.c b/nvme.c
index 5b0bbae4e2e47dddb76bd7aaddc1f6d71bd97fce..1cadf32473a4c34a0a6aafa8caa32fd5840f1085 100644 (file)
--- a/nvme.c
+++ b/nvme.c
@@ -44,12 +44,6 @@
 #include <hugetlbfs.h>
 #endif
 
-#ifdef CONFIG_OPENSSL
-#include <openssl/engine.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#endif
-
 #include <linux/fs.h>
 
 #include <sys/mman.h>
@@ -6682,6 +6676,7 @@ static int show_hostnqn_cmd(int argc, char **argv, struct command *command, stru
        return 0;
 }
 
+
 static int gen_dhchap_key(int argc, char **argv, struct command *command, struct plugin *plugin)
 {
        const char *desc = "Generate a DH-HMAC-CHAP host key usable "\
@@ -6694,17 +6689,12 @@ static int gen_dhchap_key(int argc, char **argv, struct command *command, struct
                "(0 = none, 1 = SHA-256, 2 = SHA-384, 3 = SHA-512).";
        const char *nqn = "Host NQN to use for key transformation.";
 
-       char *raw_secret;
+       unsigned char *raw_secret;
        unsigned char key[68];
        char encoded_key[128];
        unsigned long crc = crc32(0L, NULL, 0);
        int err = 0;
-#ifdef CONFIG_OPENSSL
-       const EVP_MD *md = NULL;
-       const char *hostnqn;
-#else
-       const char *md = NULL;
-#endif
+
        struct config {
                char *secret;
                unsigned int key_len;
@@ -6736,19 +6726,8 @@ static int gen_dhchap_key(int argc, char **argv, struct command *command, struct
                return -EINVAL;
        }
        if (cfg.hmac > 0) {
-#ifdef CONFIG_OPENSSL
-               if (!cfg.nqn) {
-                       hostnqn = nvmf_hostnqn_from_file();
-                       if (!hostnqn) {
-                               fprintf(stderr, "Could not read host NQN\n");
-                               return -ENOENT;
-                       }
-               } else {
-                       hostnqn = cfg.nqn;
-               }
                switch (cfg.hmac) {
                case 1:
-                       md = EVP_sha256();
                        if (!cfg.key_len)
                                cfg.key_len = 32;
                        else if (cfg.key_len != 32) {
@@ -6758,7 +6737,6 @@ static int gen_dhchap_key(int argc, char **argv, struct command *command, struct
                        }
                        break;
                case 2:
-                       md = EVP_sha384();
                        if (!cfg.key_len)
                                cfg.key_len = 48;
                        else if (cfg.key_len != 48) {
@@ -6768,7 +6746,6 @@ static int gen_dhchap_key(int argc, char **argv, struct command *command, struct
                        }
                        break;
                case 3:
-                       md = EVP_sha512();
                        if (!cfg.key_len)
                                cfg.key_len = 64;
                        else if (cfg.key_len != 64) {
@@ -6780,11 +6757,6 @@ static int gen_dhchap_key(int argc, char **argv, struct command *command, struct
                default:
                        break;
                }
-#else
-               fprintf(stderr, "HMAC transformation not supported; "\
-                       "recompile with OpenSSL support.\n");
-               return -EINVAL;
-#endif
        } else if (!cfg.key_len)
                cfg.key_len = 32;
 
@@ -6817,27 +6789,18 @@ static int gen_dhchap_key(int argc, char **argv, struct command *command, struct
                }
        }
 
-       if (md) {
-#ifdef CONFIG_OPENSSL
-               HMAC_CTX *hmac_ctx = HMAC_CTX_new();
-               const char hmac_seed[] = "NVMe-over-Fabrics";
-               unsigned int key_len;
-
-               ENGINE_load_builtin_engines();
-               ENGINE_register_all_complete();
-
-               HMAC_Init_ex(hmac_ctx, raw_secret, cfg.key_len,md, NULL);
-               HMAC_Update(hmac_ctx, (unsigned char *)hostnqn,
-                           strlen(hostnqn));
-               HMAC_Update(hmac_ctx, (unsigned char *)hmac_seed,
-                           strlen(hmac_seed));
-               HMAC_Final(hmac_ctx, key, &key_len);
-               HMAC_CTX_free(hmac_ctx);
-#endif
-       } else {
-               memcpy(key, raw_secret, cfg.key_len);
+       if (!cfg.nqn) {
+               cfg.nqn = nvmf_hostnqn_from_file();
+               if (!cfg.nqn) {
+                       fprintf(stderr, "Could not read host NQN\n");
+                       return -ENOENT;
+               }
        }
 
+       if (nvme_gen_dhchap_key(cfg.nqn, cfg.hmac, cfg.key_len,
+                               raw_secret, key) < 0)
+               return -errno;
+
        crc = crc32(crc, key, cfg.key_len);
        key[cfg.key_len++] = crc & 0xff;
        key[cfg.key_len++] = (crc >> 8) & 0xff;

diff --git a/subprojects/openssl.wrap b/subprojects/openssl.wrap
deleted file mode 100644 (file)
index c4c1412..0000000
--- a/subprojects/openssl.wrap
+++ /dev/null
@@ -1,14 +0,0 @@
-[wrap-file]
-directory = openssl-1.1.1l
-source_url = https://www.openssl.org/source/openssl-1.1.1l.tar.gz
-source_filename = openssl-1.1.1l.tar.gz
-source_hash = 0b7a3e5e59c34827fe0c3a74b7ec8baef302b98fa80088d7f9153aa16fa76bd1
-patch_filename = openssl_1.1.1l-2_patch.zip
-patch_url = https://wrapdb.mesonbuild.com/v2/openssl_1.1.1l-2/get_patch
-patch_hash = 852521fb016fa2deee8ebf9ffeeee0292c6de86a03c775cf72ac04e86f9f177e
-
-[provide]
-libcrypto = libcrypto_dep
-libssl = libssl_dep
-openssl = openssl_dep
-