Skip to content

Conversation

@martin-gpy
Copy link
Contributor

Secure channel concat TLS has some specific prerequisites and conditions. So add appropriate error messages for each of these.

--tls and --concat are mutually exclusive and not meant to be
invoked together. So add an appropriate error message for
the same.

Signed-off-by: Martin George <[email protected]>
--concat requires a corresponding dhchap-secret key to be passed
with it. So add an appropriate error message if this is not done.

Signed-off-by: Martin George <[email protected]>
--concat works only with unidirectional auth and not bidirectional auth.
As per section 8.3.4.5.9 Generated PSK for TLS in the NVMe base spec 2.1:

"The host may request secure channel concatenation with the TLS protocol
by setting the SC_C field in the AUTH_Negotiate message to NEWTLSPSK
while performing only unidirectional auth. In this case, the host shall
send a challenge value C2 to the controller and clear the sequence
number S2 to 0h to indicate that controller authentication is not
requested".

In the kernel too, if both host and controller auth keys are specified
with secure channel concat, it would ignore the controller key and
and default to using the host key itself for uni-auth with concat TLS.
So add an appropriate error to catch the same in the userspace itself.

Signed-off-by: Martin George <[email protected]>
@igaw igaw merged commit 5fdc131 into linux-nvme:master Jan 16, 2026
19 of 20 checks passed
@igaw
Copy link
Collaborator

igaw commented Jan 16, 2026

Thanks a lot. We should also update the documentation with this information. When the kernel eventually also supports to access the dhchap keys from the kernel keystore, we should update the error messages. But that's for another day.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants