HomeClusterLabs Projects

[crypto] Try crypt and decrypt on crypto_init

Description

[crypto] Try crypt and decrypt on crypto_init

Crypt (or decrypt) operation might fail in some cases even when
initialization succeeded. This problem is known to happen when
FIPS mode is enabled and combination of openssl/aes192 and md5 is used.
This was not caught during crypto_init so knet user (corosync) was
not aware of non-working crypto so it couldn't handle it - and couldn't
send/receive any packets.

Solution is to try crypt, decrypt and compare of result buffer right
after new crypto_instance is created. If any of these operation fails,
whole crypto_init fails, crypto_instance is freed and knet user is
notified by receiving non-zero return code.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

Details

Provenance
jfriesseAuthored on Aug 14 2023, 6:13 AM
fabbioneCommitted on Aug 14 2023, 11:38 AM
Parents
rKa40c3549012f: Merge pull request #404 from kronosnet/stable1-proposed
Branches
Unknown
Tags
Unknown