nvme-auth: target: remove obsolete crypto_has_shash() checks

Since nvme-auth is now doing its HMAC computations using the crypto
library, it's guaranteed that all the algorithms actually work.
Therefore, remove the crypto_has_shash() checks which are now obsolete.

However, the caller in nvmet_auth_negotiate() seems to have also been
relying on crypto_has_shash(nvme_auth_hmac_name(host_hmac_id)) to
validate the host_hmac_id.  Therefore, make it validate the ID more
directly by checking whether nvme_auth_hmac_hash_len() returns 0 or not.

Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index f483e1fd48accb70a9619bcdace64fc09db2b0f6..08c1783d70fc4a995056a085fd0cbf0c743eb433 100644 (file)
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -45,15 +45,6 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
                         key_hash);
                return -EINVAL;
        }
-       if (key_hash > 0) {
-               /* Validate selected hash algorithm */
-               const char *hmac = nvme_auth_hmac_name(key_hash);
-
-               if (!crypto_has_shash(hmac, 0, 0)) {
-                       pr_err("DH-HMAC-CHAP hash %s unsupported\n", hmac);
-                       return -ENOTSUPP;
-               }
-       }
        dhchap_secret = kstrdup(secret, GFP_KERNEL);
        if (!dhchap_secret)
                return -ENOMEM;

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 3088e044dbcbb23d5d14d29db2d44d05ecf9a188..463348c7f097bc5d45be4690110314ebe43a82bc 100644 (file)
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -17,7 +17,6 @@
 #include <linux/nvme-auth.h>
 #endif
 #include <linux/nvme-keyring.h>
-#include <crypto/hash.h>
 #include <crypto/kpp.h>
 #include <linux/nospec.h>
 
@@ -2181,8 +2180,6 @@ static ssize_t nvmet_host_dhchap_hash_store(struct config_item *item,
        hmac_id = nvme_auth_hmac_id(page);
        if (hmac_id == NVME_AUTH_HASH_INVALID)
                return -EINVAL;
-       if (!crypto_has_shash(nvme_auth_hmac_name(hmac_id), 0, 0))
-               return -ENOTSUPP;
        host->dhchap_hash_id = hmac_id;
        return count;
 }

diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 5946681cb0e322d4d1e4b1c24d78f9a759767bd5..b703e3bebae4e4b3b89aa1c87efad88288ab5db1 100644 (file)
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -8,7 +8,6 @@
 #include <linux/blkdev.h>
 #include <linux/random.h>
 #include <linux/nvme-auth.h>
-#include <crypto/hash.h>
 #include <crypto/kpp.h>
 #include "nvmet.h"
 
@@ -75,8 +74,7 @@ static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d)
        for (i = 0; i < data->auth_protocol[0].dhchap.halen; i++) {
                u8 host_hmac_id = data->auth_protocol[0].dhchap.idlist[i];
 
-               if (!fallback_hash_id &&
-                   crypto_has_shash(nvme_auth_hmac_name(host_hmac_id), 0, 0))
+               if (!fallback_hash_id && nvme_auth_hmac_hash_len(host_hmac_id))
                        fallback_hash_id = host_hmac_id;
                if (ctrl->shash_id != host_hmac_id)
                        continue;