Re: [PATCH] scsi: target: iscsi: Use crypto library API

[David Disseldorp]

This looks like a worthwhile clean-up and doesn't trigger any libiscsi
chap test regressions.
Reviewed-by: David Disseldorp <ddiss@xxxxxxx>

I do have one minor concern: 

On Wed, 30 Sep 2026 21:48:57 -0700, Eric Biggers wrote:

> Make iscsi_target_auth.c call into the crypto library directly instead
> of going through crypto_shash.  This is simpler and much more efficient,
> as it avoids overhead of the crypto_shash layer.  The hash computation
> itself also no longer has error codes that need to be checked.
> 
> For simplicity, still do a memory allocation per operation to buffer the
> data (which is typically less than 50 bytes here) so that the one-shot
> digest functions can be used.  It's still much more efficient than doing
> the super slow crypto_alloc_shash().
> 
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> ---
>  drivers/target/iscsi/Kconfig             |   7 +-
>  drivers/target/iscsi/iscsi_target_auth.c | 192 +++++++++--------------
>  drivers/target/iscsi/iscsi_target_auth.h |   8 +-
>  3 files changed, 78 insertions(+), 129 deletions(-)
...
> @@ -113,17 +143,17 @@ static int chap_check_algorithm(const char *a_str)
>  		if (kstrtol(token, 10, &digest_type))
>  			continue;
>  
> -		digest_name = chap_get_digest_name(digest_type);
> -		if (!digest_name)
> +		if (fips_enabled && digest_type == CHAP_DIGEST_MD5)
>  			continue;

Could e.g. SHA1 also require fips filtering here in future? If so, would
it make sense to track the fips compat status (preferably at build time)
in chap_digest_algs?