nvme: require TLS PSKs to be specified via keyring

It's no longer possible to pass the key directly in spdk_nvme_ctrl_opts.
This method was deprecated and was supposed to be removed in the
upcoming

nvme: require TLS PSKs to be specified via keyring

It's no longer possible to pass the key directly in spdk_nvme_ctrl_opts.
This method was deprecated and was supposed to be removed in the
upcoming release.

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: If06e087abb83da6b2f22c4a9f7129720f26e6f0d
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/24810
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Community-CI: Mellanox Build Bot
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>

show more ...

test/fips: store TLS PSK in tmpfs

It makes it possible to run this test with repo mounted over nfs, as
keyring_file checks the ownership of the file, which can be different
with nfs (due to squashin

test/fips: store TLS PSK in tmpfs

It makes it possible to run this test with repo mounted over nfs, as
keyring_file checks the ownership of the file, which can be different
with nfs (due to squashing).

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: Ib05804f116498f137b1499d8eb10fcd60cf18f0e
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/24806
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>

show more ...

nvmf/tcp: require TLS PSKs to be specified via keyring

It's no longer possible to set TLS PSKs by specifying a path to the file
containing the key. This method was deprecated and was supposed to be

nvmf/tcp: require TLS PSKs to be specified via keyring

It's no longer possible to set TLS PSKs by specifying a path to the file
containing the key. This method was deprecated and was supposed to be
removed in the upcoming release.

Signed-off-by: Konrad Sztyber <konrad.sztyber@intel.com>
Change-Id: Idfa4c935bd97f20c020779d90b186607f24bb525
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/24805
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Aleksey Marchuk <alexeymar@nvidia.com>
Community-CI: Mellanox Build Bot
Reviewed-by: Jim Harris <jim.harris@samsung.com>

show more ...

scripts/check_format: Adjust bash code to adhere to shfmt v3.8.0

This bump ensures some of the obscure formatting bugs are finally
squashed. All the adjustments introduced here adhere to what we
alr

scripts/check_format: Adjust bash code to adhere to shfmt v3.8.0

This bump ensures some of the obscure formatting bugs are finally
squashed. All the adjustments introduced here adhere to what we
already try to enforce across the entire repo, but due to said bugs
could not be implemented.

Remove SHFMT_NO_EDITORCONFIG since it's not supported in latest
shfmt releases.

This patch doesn't introduce any functional change in the updated
files.

Change-Id: Ia2b011b86c8fe12376c4a8455ee638473a9f7179
Signed-off-by: Michal Berger <michal.berger@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/23088
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Konrad Sztyber <konrad.sztyber@intel.com>
Reviewed-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com>
Community-CI: Mellanox Build Bot

show more ...

test/nvmf/fips: Don't export OPENSSL_FORCE_FIPS_MODE

This is redundant since we already do this explicitly in the custom
.cnf. Also, it breaks initialization under redhat's openssl 3.1.1 where
the 0

test/nvmf/fips: Don't export OPENSSL_FORCE_FIPS_MODE

This is redundant since we already do this explicitly in the custom
.cnf. Also, it breaks initialization under redhat's openssl 3.1.1 where
the 0032-Force-fips.patch changed quite significantly - it seems it no
longer checks if given provider was already activated|loaded hence the
provider_conf_activate() fails when the second attempt is made.

Previous iteration of this patch was flipping ok to 1 when provider was
already active here it remains 0.

To avoid this, simply don't export OPENSSL_FORCE_FIPS_MODE to make sure
all needed providers (base + fips) are loaded solely based on our .cnf.

Change-Id: I00e007360fac51754fa8c246394e4a5ecf4ffc07
Signed-off-by: Michal Berger <michal.berger@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/21972
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Konrad Sztyber <konrad.sztyber@intel.com>
Reviewed-by: Jim Harris <jim.harris@samsung.com>

show more ...

test: add FIPS test

Add a test that sets OpenSSL FIPS provider via
configuration file and then runs NVMf TLS.

The main goal here is to ensure that configuring
OpenSSL to work with FIPS provided doe

test: add FIPS test

Add a test that sets OpenSSL FIPS provider via
configuration file and then runs NVMf TLS.

The main goal here is to ensure that configuring
OpenSSL to work with FIPS provided does not impact
any SPDK areas negatively (i.e. FIPS configuration
contains implementation of every OpenSSL function
accross SPDK).

Change-Id: Ia9e24d993e9112ce96897b6c485f52d1def64355
Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/20696
Reviewed-by: Jim Harris <jim.harris@samsung.com>
Reviewed-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com>
Reviewed-by: Michal Berger <michal.berger@intel.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>

show more ...