keyring: pass module in spdk_keyring_remove_key()

This ensures that the key will only be removed if the module matches the
module owning the key. Also, while here, make this function return a
statu

keyring: pass module in spdk_keyring_remove_key()

This ensures that the key will only be removed if the module matches the
module owning the key. Also, while here, make this function return a
status indicating whether the key was removed successfully.

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: Iaabf863edd87863ddcb4b9b23831672b10eedb07
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/24807
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>
Community-CI: Mellanox Build Bot
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <jim.harris@samsung.com>

show more ...

keyring: add spdk_key_dup()

It's often useful to increase the refcnt of a key, e.g. to transfer its
ownership. It could be achieved by doing
spdk_keyring_get(spdk_key_get_name(key)), but spdk_key_d

keyring: add spdk_key_dup()

It's often useful to increase the refcnt of a key, e.g. to transfer its
ownership. It could be achieved by doing
spdk_keyring_get(spdk_key_get_name(key)), but spdk_key_dup(key) is less
cumbersome.

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I805e0fe8a7ef154d19fe62621d5e736585620715
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/22653
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Reviewed-by: Ben Walker <ben@nvidia.com>
Community-CI: Mellanox Build Bot

show more ...

keyring: allow modules to return ENODEV

It allows registered modules to be marked as unavailable, e.g. because
the module was disabled in configuration.

Signed-off-by: Konrad Sztyber <konrad.sztybe

keyring: allow modules to return ENODEV

It allows registered modules to be marked as unavailable, e.g. because
the module was disabled in configuration.

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: Iff7e2cb9d85d515c2aa017baf2920525c43279fd
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21759
Community-CI: Mellanox Build Bot
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <jim.harris@samsung.com>

show more ...

keyring: add probe_key

This callback makes it possible to implement keyring modules that
instantiate the keys only once they're requested by the user. For
instance, a module can check if the key is

keyring: add probe_key

This callback makes it possible to implement keyring modules that
instantiate the keys only once they're requested by the user. For
instance, a module can check if the key is available in a remote key
server and fetch it over the network.

Since probed keys are added to the keyring implicitly, they're removed
once the last reference to a key is released. Users can still
explicitly remove such keys while they're still in use - in this case
the references are still valid, but they cannot be used to retrieve the
keying material.

To make it possible to add a key from within the probe_key() callback,
g_keyring.mutex was changed to be recursive. That's because probe_key()
is called with the mutex held, and spdk_keyring_add_key() takes it
again.

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I4852c8371c076bdf0f6cfce16cd86619ac4b8c7a
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21758
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>
Community-CI: Mellanox Build Bot
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <jim.harris@samsung.com>

show more ...

keyring: support for writing config

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I326512277231f57957a6d6992d62edf692650905
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/sp

keyring: support for writing config

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I326512277231f57957a6d6992d62edf692650905
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21740
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>

show more ...

keyring: add RPC for listing available keys

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I4f9f6753fa616bc1c61abb43656f95c91abf3120
Reviewed-on: https://review.spdk.io/gerrit/c

keyring: add RPC for listing available keys

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I4f9f6753fa616bc1c61abb43656f95c91abf3120
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21739
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>

show more ...

lib: add keyring library

The purpose of this library is to provide other libraries with an
interface for retrieving cryptographic keys. This interface consists of
functions managing the keyring (ad

lib: add keyring library

The purpose of this library is to provide other libraries with an
interface for retrieving cryptographic keys. This interface consists of
functions managing the keyring (add/remove), keeping track of key
references (get/put), and a set of callbacks used to define modules
responsible for providing access to the keys in a secure manner.

Key objects (called spdk_key) are identified by a unique name. They
don't hold the keying material themselves, but only act as references to
the actual key. Once the key is needed to perform a crypto operation,
this reference is used to retrieve keying material. These objects are
refcounted, so it is safe to remove a key from the keyring while it's
still in use. If that happens, the spdk_key object remains valid, but
it cannot be used to obtain the key (i.e. spdk_key_get_key() will result
in -ENOKEY).

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I5324fa28d5828a989b003bb5f715cfcac2077262
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21734
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>

show more ...