tls key lookup matches too eagerly?

[Daniel Wagner]

Hi Hannes,

While testing my TLS handling changes in nvme-cli/libnvme, I found out
that it is possible to insert a key with a identity of "NVMe1R01" only
and the kernel was happy to use this key.

nvme_tls_psk_lookup
  keyring_search
  	struct keyring_search_context ctx = {
		.index_key.description	= description,
		.index_key.desc_len	= strlen(description),
        	.match_data.cmp		= key_default_cmp,
                [...]
        }

/*
 * By default, we keys found by getting an exact match on their descriptions.
 */
bool key_default_cmp(const struct key *key,
		     const struct key_match_data *match_data)
{
	return strcmp(key->description, match_data->raw_data) == 0;
}

I think we should at least enforce that the identity set by user space
fullfills the required format. Does this make sense?

Daniel