nvme: add testcase for TLS-encrypted connections

TCP connections can be encrypted using in-kernel TLS, so add a testcase to exercise the various combinations. Signed-off-by: Hannes Reinecke <[email protected]>
osandov · hreinecke · Sep 26, 2024 · Sep 27, 2024 · Sep 27, 2024 · Oct 1, 2024
commit 340eeba5c319be5cbef8cf91f13759fe5833db21
diff --git a/tests/nvme/056 b/tests/nvme/056
@@ -0,0  1,93 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-3.0 
 # Copyright (C) 2024 Hannes Reinecke, SUSE Labs
 #
 # Create TLS-encrypted connections
 
 . tests/nvme/rc
 
 DESCRIPTION="Create TLS-encrypted connections"
 QUICK=1
 
 requires() {
 	_nvme_requires
 	_have_loop
 	_have_kernel_option NVME_TCP_TLS
 	_have_kernel_option NVME_TARGET_TCP_TLS
 	_require_kernel_nvme_fabrics_feature tls
 	_require_nvme_trtype_is_tcp
 	_require_nvme_cli_tls
 }
 
 set_conditions() {
 	_set_nvme_trtype "$@"
 }
 
 test() {
 	echo "Running ${TEST_NAME}"
 
 	_setup_nvmet
 
 	local hostkey
 	local ctrl
 
 	hostkey=$(nvme gen-tls-key -n "${def_hostnqn}" -c "${def_subsysnqn}" -m 1 -I 1 -i 2> /dev/null)
 	if [ -z "$hostkey" ] ; then
 		echo "nvme gen-tls-key failed"
 		return 1
 	fi
 
 	systemctl start tlshd
 
 	_nvmet_target_setup --blkdev file --tls
 
 	# Test unencrypted connection
 	echo "Test unencrypted connection w/ tls not required"
 	_nvme_connect_subsys
 
 	ctrl=$(_find_nvme_dev)
 	if _check_ctrl_tls "$ctrl" 2> /dev/null; then
 		echo "WARNING: connection is encrypted"
 	fi
 
 	_nvme_disconnect_subsys
 
 	# Test encrypted connection
 	echo "Test encrypted connection w/ tls not required"
 	_nvme_connect_subsys --tls
 
 	ctrl=$(_find_nvme_dev)
 	if ! _check_ctrl_tls "$ctrl" > /dev/null ; then
                 echo "WARNING: connection is not encrypted"
         fi
 
 	_nvme_disconnect_subsys
 
 	# Reset target configuration
 	_nvmet_target_cleanup
 
 	_nvmet_target_setup --blkdev file --force-tls
 
 	# Test unencrypted connection
 	echo "Test unencrypted connection w/ tls required (should fail)"
 	_nvme_connect_subsys
 
 	_nvme_disconnect_subsys
 
 	# Test encrypted connection
 	echo "Test encrypted connection w/ tls required"
 	_nvme_connect_subsys --tls
 
 	ctrl=$(_find_nvme_dev)
         if ! _check_ctrl_tls "$ctrl" > /dev/null; then
                 echo "WARNING: connection is not encrypted"
         fi
 
 	_nvme_disconnect_subsys
 
 	systemctl stop tlshd
 
 	_nvmet_target_cleanup
 
 	echo "Test complete"
 }
diff --git a/tests/nvme/056.out b/tests/nvme/056.out
@@ -0,0  1,10 @@
 Running nvme/056
 Test unencrypted connection w/ tls not required
 disconnected 1 controller(s)
 Test encrypted connection w/ tls not required
 disconnected 1 controller(s)
 Test unencrypted connection w/ tls required (should fail)
 disconnected 0 controller(s)
 Test encrypted connection w/ tls required
 disconnected 1 controller(s)
 Test complete
diff --git a/tests/nvme/rc b/tests/nvme/rc
@@ -168,6  168,14 @@ _require_nvme_cli_auth() {
 	return 0
 }
 
 _require_nvme_cli_tls() {
 	if ! nvme gen-tls-key --subsysnqn nvmf-test-subsys > /dev/null 2>&1; then
 		SKIP_REASON =("nvme gen-tls-key command missing")
 		return 1
 	fi
 	return 0
 }
 
 _require_kernel_nvme_fabrics_feature() {
 	local feature="$1"
 
@@ -563,3  571,9 @@ _nvme_reset_ctrl() {
 _nvme_delete_ctrl() {
 	echo 1 > /sys/class/nvme/"$1"/delete_controller
 }
 
 _check_ctrl_tls() {
 	local ctrl="$1"
 
 	cat /sys/class/nvme/"$ctrl"/tls_key
 }