Re: [PATCH] nvme: auth: validate DHCHAP secret before stopping authentication

[Hannes Reinecke <hare@suse.de>]

On 10/3/26 2:51 PM, Sreeraj S Kurup wrote:
> Hi Hannes,
> 
> Yes, I agree that stopping the currently running authentication when the admin
> requests a new one is intentional.
> 
> The issue I was pointing out is slightly different: if the new key is invalid,
 > we never actually get to the point where the new authentication can be
 > started again. "nvme_auth_stop()" has already stopped the existing
 > authentication, and the parser returns an error before the restart
 > path is reached.>
> So the question is whether writing an invalid replacement key should
 > leave the previous authentication stopped, or whether the key should
 > first be parsed/validated and only then replace the existing
 > authentication state.>
> If the intended semantics are that an invalid key write should not
 > disturb an already running authentication, then moving the validation
 > before "nvme_auth_stop()" would make the operation effectively
 > transactional:>
> validate new key
>      -> error: leave existing authentication unchanged
>      -> success: stop old authentication and start with new key
> 
> If, however, the intended semantics are that any attempted replacement
 > stops the existing authentication even when the replacement is
 > invalid, then I agree that the current behaviour is intentional and
 > the patch doesn't fix a bug.>
Hmm. Actually, I'm not sure. Both sides have something going for it.
Stopping the transaction first follows the perceived will of the admin
to start a new authentication. And that will is arguably independent
on the question as to whether the new key is valid.
But at the same time one cannot start a new authentication if the key
is invalid.

So I don't know. Let me think.

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich