[PATCH 07/18] nvme-keyring: implement nvme_tls_psk_default()

[Sagi Grimberg]

On 3/29/23 16:59, Hannes Reinecke wrote:
> Implement a function to select the 'best' PSK for TLS.
> 
> Signed-off-by: Hannes Reinecke <hare at suse.de>
> ---
>   drivers/nvme/common/keyring.c | 47 +++++++++++++++++++++++++++++++++++
>   include/linux/nvme-keyring.h  |  2 ++
>   2 files changed, 49 insertions(+)
> 
> diff --git a/drivers/nvme/common/keyring.c b/drivers/nvme/common/keyring.c
> index 4ac33538f839..ca36a061bd48 100644
> --- a/drivers/nvme/common/keyring.c
> +++ b/drivers/nvme/common/keyring.c
> @@ -103,6 +103,53 @@ struct key *nvme_tls_psk_lookup(struct key *keyring,
>   }
>   EXPORT_SYMBOL_GPL(nvme_tls_psk_lookup);
>   
> +/*
> + * NVMe PSK priority list
> + *
> + * 'Retained' PSKs (ie 'generated == false')
> + * should be preferred to 'generated' PSKs,
> + * and SHA-384 should be preferred to SHA-256.
> + */
> +struct nvme_psk_priority_list {

nvme_tls_psk_priority_list

> +	bool generated;
> +	enum nvme_tcp_tls_cipher cipher;
> +} nvme_psk_prio[] = {

nvme_tls_psk_prio

> +	{ .generated = false,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
> +	{ .generated = false,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
> +	{ .generated = true,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA384, },
> +	{ .generated = true,
> +	  .cipher = NVME_TCP_TLS_CIPHER_SHA256, },
> +};
> +
> +/*
> + * nvme_tls_psk_default - Return 'best' PSK to use for TLS ClientHello

s/'best'/the preferred/...