Page MenuHomeFreeBSD
Files F177570778

D61553.1794768353.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D61553.1794768353.diff
View Options

diff --git a/usr.sbin/ctld/nvmf.hh b/usr.sbin/ctld/nvmf.hh
--- a/usr.sbin/ctld/nvmf.hh
+++ b/usr.sbin/ctld/nvmf.hh
@@ -49,6 +49,8 @@
protected:
struct nvmf_association *association() { return p_association.get(); }
+ bool host_permitted(const struct auth_group *ag, const char *subnqn,
+ const char *hostnqn, const struct sockaddr *client_sa);
private:
struct nvmf_association_params p_aparams;
diff --git a/usr.sbin/ctld/nvmf.cc b/usr.sbin/ctld/nvmf.cc
--- a/usr.sbin/ctld/nvmf.cc
+++ b/usr.sbin/ctld/nvmf.cc
@@ -188,6 +188,35 @@
return true;
}
+bool
+nvmf_portal::host_permitted(const struct auth_group *ag, const char *subnqn,
+ const char *hostnqn, const struct sockaddr *client_sa)
+{
+ switch (ag->type()) {
+ case auth_type::UNKNOWN:
+ log_warn("auth-type not set, denying access to %s", subnqn);
+ return (false);
+ case auth_type::DENY:
+ log_warn("Connection to %s denied by auth-type", subnqn);
+ return (false);
+ default:
+ break;
+ }
+
+ if (!ag->host_permitted(hostnqn)) {
+ log_warn("Host %s does not match allowed names for %s",
+ hostnqn, subnqn);
+ return (false);
+ }
+ if (!ag->host_permitted(client_sa)) {
+ log_warn("Host %s does not match allowed addresses for %s",
+ hostnqn, subnqn);
+ return (false);
+ }
+
+ return (true);
+}
+
portal_group_up
nvmf_make_transport_group(struct conf *conf, std::string_view name)
{
@@ -453,6 +482,16 @@
return;
}
+ const struct auth_group *ag = port->auth_group();
+ if (ag == nullptr)
+ ag = port->target()->auth_group();
+ if (!host_permitted(ag, (char *)data.subnqn, (char *)data.hostnqn,
+ client_sa)) {
+ nvmf_connect_error(nc, NVME_SCT_COMMAND_SPECIFIC,
+ NVMF_FABRIC_SC_INVALID_HOST);
+ return;
+ }
+
struct ctl_nvmf req;
memset(&req, 0, sizeof(req));
req.type = CTL_NVMF_HANDOFF;
diff --git a/usr.sbin/ctld/nvmf_discovery.cc b/usr.sbin/ctld/nvmf_discovery.cc
--- a/usr.sbin/ctld/nvmf_discovery.cc
+++ b/usr.sbin/ctld/nvmf_discovery.cc
@@ -502,6 +502,14 @@
return;
}
+ const struct auth_group *ag = portal_group()->discovery_auth_group();
+ if (!host_permitted(ag, (char *)data.subnqn, (char *)data.hostnqn,
+ client_sa)) {
+ nvmf_connect_error(nc, NVME_SCT_COMMAND_SPECIFIC,
+ NVMF_FABRIC_SC_INVALID_HOST);
+ return;
+ }
+
/* Just use a controller ID of 1 for all discovery controllers. */
int error = nvmf_finish_accept(nc, 1);
if (error != 0) {

File Metadata

Mime Type
text/plain
Expires
Sun, Nov 15, 6:45 PM (23 h, 29 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41746772
Default Alt Text
D61553.1794768353.diff (2 KB)

Event Timeline