tls key generation rfc8446 update causes regressions

[igaw]

• nvme connect is missing --compat
• following simple test case does not pass. all works fine with nvme-cli v2.14 and libnvme v1.14 (without the --compat option)

test3() {
  echo "---- connect with key in keystore"
  "${NVME}" gen-tls-key --hostnqn "${hostnqn}"  --subsysnqn "${subsysnqn}" \
                        --secret "${secret}" --hmac 1 --identity 1 --insert --compat
  exec_test "${NVME}" connect ${common_args} --tls --dhchap-secret="${host_secret}" --dhchap-ctrl-secret="${ctrl_secret}" --dump-config --output-format json
  cat <<EOF > expected.json
[
  {
    "hostnqn":"${hostnqn}",
    "hostid":"${hostid}",
    "dhchap_key":"${host_secret}",
    "subsystems":[
      {
        "nqn":"${subsysnqn}",
        "ports":[
          {
            "transport":"tcp",
            "traddr":"${addr}",
            "trsvcid":"${port}",
            "dhchap_key":"${host_secret}",
            "dhchap_ctrl_key":"${ctrl_secret}",
            "tls":true
          }
        ]
      }
    ]
  }
]
EOF
  diff -u expected.json output
  rm expected.json
  echo ""
  "${NVME}" tls --revoke "${identity}"
}

[igaw]

I am using test-tls.sh for testing with two VMs. The target VM runs an 6.12 kernel, thus all test cases should pass by adding --compat

[hreinecke]

Errm. Are you sure you want to test TLS and authentication at the same time?
Shouldn't you rather use the --concat option instead of --tls to use secure concatenation?

[hreinecke]

And clearly it also depends on how you load the TLS key on the other side. If the key is loaded with --compat you need to use the --compat option on this VM, too. And vice versa, obviously.
But using --compat on one side and no --compat on the other won't work.

[hreinecke]

In the light of this I would maybe extend the test case to try a connection without compat first, and try with the --compat option if the first attempt fails. One of these must succeed for the test to be successful, but a failure on the first case is actually okay (as this is precisely why we added the --compat option in the first place ...)

[igaw]

I am testing if --compat is working. The target is not modified and runs a kernel without support for the rfc8446 hashes. The host kernel is not changed during the test also doesn't support the rfc8446. The only thing which changed is nvme-cli/libnvme. In this scenario, all should keep working fine when --compat is used.

I'll make a note to extend the test script to cover also the --concat case. I test TLS and authentication at the same time because the target side is not configurable at the moment. Need to look into this.

[igaw]

test3 fails because "${NVME}" show-topology --output-format json output has changed as well. After updating the jq query this part works.

The only test case still fails is test1:

test1() {
  echo "---- connect with configured key on command line"
  exec_test "${NVME}" connect ${common_args} --tls --tls-key "${psk}" --dhchap-secret="${host_secret}" --dhchap-ctrl-secret="${ctrl_secret}"
}