|
 |
ebaf6b |
From 4a2f48b17b06638d3d3adcae683aff1639351434 Mon Sep 17 00:00:00 2001
|
|
|
ebaf6b |
From: Jan Friesse <jfriesse@redhat.com>
|
|
|
ebaf6b |
Date: Tue, 10 Nov 2020 18:10:17 +0100
|
|
|
ebaf6b |
Subject: [PATCH] totemknet: Check both cipher and hash for crypto
|
|
|
ebaf6b |
|
|
|
ebaf6b |
Previously only crypto cipher was used as a way to find out if crypto is
|
|
|
ebaf6b |
enabled or disabled.
|
|
|
ebaf6b |
|
|
|
ebaf6b |
This usually works ok until cipher is set to none and hash to some other
|
|
|
ebaf6b |
value (like sha1). Such config is perfectly valid and it was not
|
|
|
ebaf6b |
supported correctly.
|
|
|
ebaf6b |
|
|
|
ebaf6b |
As a solution, check both cipher and hash.
|
|
|
ebaf6b |
|
|
|
ebaf6b |
Signed-off-by: Jan Friesse <jfriesse@redhat.com>
|
|
|
ebaf6b |
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
|
|
|
ebaf6b |
Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
|
|
|
ebaf6b |
---
|
|
|
ebaf6b |
exec/totemknet.c | 18 +++++++++++++-----
|
|
|
ebaf6b |
1 file changed, 13 insertions(+), 5 deletions(-)
|
|
|
ebaf6b |
|
|
|
ebaf6b |
diff --git a/exec/totemknet.c b/exec/totemknet.c
|
|
|
ebaf6b |
index c6a1649d..0834e8e4 100644
|
|
|
ebaf6b |
--- a/exec/totemknet.c
|
|
|
ebaf6b |
+++ b/exec/totemknet.c
|
|
|
ebaf6b |
@@ -905,6 +905,14 @@ static void totemknet_add_config_notifications(struct totemknet_instance *instan
|
|
|
ebaf6b |
LEAVE();
|
|
|
ebaf6b |
}
|
|
|
ebaf6b |
|
|
|
ebaf6b |
+static int totemknet_is_crypto_enabled(const struct totemknet_instance *instance)
|
|
|
ebaf6b |
+{
|
|
|
ebaf6b |
+
|
|
|
ebaf6b |
+ return (!(strcmp(instance->totem_config->crypto_cipher_type, "none") == 0 &&
|
|
|
ebaf6b |
+ strcmp(instance->totem_config->crypto_hash_type, "none") == 0));
|
|
|
ebaf6b |
+
|
|
|
ebaf6b |
+}
|
|
|
ebaf6b |
+
|
|
|
ebaf6b |
static int totemknet_set_knet_crypto(struct totemknet_instance *instance)
|
|
|
ebaf6b |
{
|
|
|
ebaf6b |
struct knet_handle_crypto_cfg crypto_cfg;
|
|
|
ebaf6b |
@@ -927,7 +935,7 @@ static int totemknet_set_knet_crypto(struct totemknet_instance *instance)
|
|
|
ebaf6b |
);
|
|
|
ebaf6b |
|
|
|
ebaf6b |
/* If crypto is being disabled we need to explicitly allow cleartext traffic in knet */
|
|
|
ebaf6b |
- if (strcmp(instance->totem_config->crypto_cipher_type, "none") == 0) {
|
|
|
ebaf6b |
+ if (!totemknet_is_crypto_enabled(instance)) {
|
|
|
ebaf6b |
res = knet_handle_crypto_rx_clear_traffic(instance->knet_handle, KNET_CRYPTO_RX_ALLOW_CLEAR_TRAFFIC);
|
|
|
ebaf6b |
if (res) {
|
|
|
ebaf6b |
knet_log_printf(LOGSYS_LEVEL_ERROR, "knet_handle_crypto_rx_clear_traffic(ALLOW) failed %s", strerror(errno));
|
|
|
ebaf6b |
@@ -1108,7 +1116,7 @@ int totemknet_initialize (
|
|
|
ebaf6b |
|
|
|
ebaf6b |
/* Enable crypto if requested */
|
|
|
ebaf6b |
#ifdef HAVE_KNET_CRYPTO_RECONF
|
|
|
ebaf6b |
- if (strcmp(instance->totem_config->crypto_cipher_type, "none") != 0) {
|
|
|
ebaf6b |
+ if (totemknet_is_crypto_enabled(instance)) {
|
|
|
ebaf6b |
res = totemknet_set_knet_crypto(instance);
|
|
|
ebaf6b |
if (res == 0) {
|
|
|
ebaf6b |
res = knet_handle_crypto_use_config(instance->knet_handle, totem_config->crypto_index);
|
|
|
ebaf6b |
@@ -1134,7 +1142,7 @@ int totemknet_initialize (
|
|
|
ebaf6b |
}
|
|
|
ebaf6b |
}
|
|
|
ebaf6b |
#else
|
|
|
ebaf6b |
- if (strcmp(instance->totem_config->crypto_cipher_type, "none") != 0) {
|
|
|
ebaf6b |
+ if (totemknet_is_crypto_enabled(instance)) {
|
|
|
ebaf6b |
res = totemknet_set_knet_crypto(instance);
|
|
|
ebaf6b |
if (res) {
|
|
|
ebaf6b |
knet_log_printf(LOG_DEBUG, "Failed to set up knet crypto");
|
|
|
ebaf6b |
@@ -1616,7 +1624,7 @@ int totemknet_crypto_reconfigure_phase (
|
|
|
ebaf6b |
switch (phase) {
|
|
|
ebaf6b |
case CRYPTO_RECONFIG_PHASE_ACTIVATE:
|
|
|
ebaf6b |
config_to_use = totem_config->crypto_index;
|
|
|
ebaf6b |
- if (strcmp(instance->totem_config->crypto_cipher_type, "none") == 0) {
|
|
|
ebaf6b |
+ if (!totemknet_is_crypto_enabled(instance)) {
|
|
|
ebaf6b |
config_to_use = 0; /* we are clearing it */
|
|
|
ebaf6b |
}
|
|
|
ebaf6b |
|
|
|
ebaf6b |
@@ -1647,7 +1655,7 @@ int totemknet_crypto_reconfigure_phase (
|
|
|
ebaf6b |
}
|
|
|
ebaf6b |
|
|
|
ebaf6b |
/* If crypto is enabled then disable all cleartext reception */
|
|
|
ebaf6b |
- if (strcmp(instance->totem_config->crypto_cipher_type, "none") != 0) {
|
|
|
ebaf6b |
+ if (totemknet_is_crypto_enabled(instance)) {
|
|
|
ebaf6b |
res = knet_handle_crypto_rx_clear_traffic(instance->knet_handle, KNET_CRYPTO_RX_DISALLOW_CLEAR_TRAFFIC);
|
|
|
ebaf6b |
if (res) {
|
|
|
ebaf6b |
knet_log_printf(LOGSYS_LEVEL_ERROR, "knet_handle_crypto_rx_clear_traffic(DISALLOW) failed %s", strerror(errno));
|
|
|
ebaf6b |
--
|
|
|
ebaf6b |
2.18.2
|
|
|
ebaf6b |
|