From: Caleb Sander <csander@purestorage.com>
Date: Tue, 20 Jun 2023 03:17:16 +0000 (-0600)
Subject: fabrics: use SECTYPE to determine whether to use TLS
X-Git-Tag: v1.7~51
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=1f5db4792021c6248844b05bce33f29f565676bf;p=users%2Fsagi%2Flibnvme.git

fabrics: use SECTYPE to determine whether to use TLS

The NVMe specfications are clear that the discovery log page entry
SECTYPE field indicates whether TLS is supported.
Currently the TREQ field is used, which results in enabling TLS
even when SECTYPE = "No Security" and TREQ = "Not required".
Only enable TLS if SECTYPE indicates a TLS version is enabled.

From the NVMe/TCP transport specification, version 1.0c:
Security Type (SECTYPE): Specifies the type of security used by the
NVMe/TCP port. If SECTYPE is a value of 0h (No Security), then the host
shall set up a normal TCP connection.

From TP 8018:
The SECTYPE value of 0h (i.e., No Security) specifies that TLS is not
supported.

From TP 8025 (the "TLS Permitted" host case):
If the SECTYPE field in the TSAS field in the discovery log entry for
the remote entity is cleared to zero and the TSC field is not set to 01b
(i.e., Required), then initiate TCP connections without TLS.

Fixes: 3962a45 ("fabrics: add fabrics config option 'tls'")
Signed-off-by: Caleb Sander <csander@purestorage.com>
---

diff --git a/src/nvme/fabrics.c b/src/nvme/fabrics.c
index 2e48ac86..37b02af8 100644
--- a/src/nvme/fabrics.c
+++ b/src/nvme/fabrics.c
@@ -1033,8 +1033,7 @@ nvme_ctrl_t nvmf_connect_disc_entry(nvme_host_t h,
 		c->cfg.disable_sqflow = true;
 
 	if (e->trtype == NVMF_TRTYPE_TCP &&
-	    (e->treq & NVMF_TREQ_REQUIRED ||
-	     e->treq & NVMF_TREQ_NOT_REQUIRED))
+	    e->tsas.tcp.sectype != NVMF_TCP_SECTYPE_NONE)
 		c->cfg.tls = true;
 
 	ret = nvmf_add_ctrl(h, c, cfg);