libknet: more crypto cleanup and allocate crypto buffers when necessary

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>

diff --git a/libknet/handle.c b/libknet/handle.c
index 0748041e78e5849bae2dac07bc76200c38668dbf..da8072444d6f7d9ec005887ce5ac57264a55f5a4 100644 (file)
--- a/libknet/handle.c
+++ b/libknet/handle.c
@@ -12,8 +12,6 @@
 
 #define KNET_MAX_EVENTS 8
 #define KNET_PING_TIMERES 200000
-#define KNET_DATABUFSIZE 131072 /* 128k */
-#define KNET_PINGBUFSIZE sizeof(struct knet_frame)
 
 static void *_handle_tap_to_links_thread(void *data);
 static void *_handle_recv_from_links_thread(void *data);

diff --git a/libknet/libknet-private.h b/libknet/libknet-private.h
index 7497196064976e64230398542f46e84a36cecd80..eb3a84659d44e475f77d440a35baee30b706e030 100644 (file)
--- a/libknet/libknet-private.h
+++ b/libknet/libknet-private.h
@@ -7,6 +7,9 @@
 
 #include "libknet.h"
 
+#define KNET_DATABUFSIZE 131072 /* 128k */
+#define KNET_PINGBUFSIZE sizeof(struct knet_frame)
+
 #define timespec_diff(start, end, diff) \
 do { \
        if (end.tv_sec > start.tv_sec) \
@@ -29,6 +32,7 @@ struct knet_handle {
        char *tap_to_links_buf_crypt;
        struct knet_frame *recv_from_links_buf;
        struct knet_frame *pingbuf;
+       char *pingbuf_crypt;
        pthread_t tap_to_links_thread;
        pthread_t recv_from_links_thread;
        pthread_t heartbt_thread;

diff --git a/libknet/nsscrypto.c b/libknet/nsscrypto.c
index 2e5aca544becceb7428a2c45edd1506830354745..d66b028bd3a95b3be3500d79bbb495e9941f8e7c 100644 (file)
--- a/libknet/nsscrypto.c
+++ b/libknet/nsscrypto.c
@@ -10,22 +10,12 @@
 #include "nsscrypto.h"
 #include "libknet-private.h"
 
-/*
- * define onwire crypto header
- */
-
-struct crypto_config_header {
-       uint8_t crypto_cipher_type;
-       uint8_t crypto_hash_type;
-       uint8_t __pad0;
-       uint8_t __pad1;
-} __attribute__((packed));
-
 /*
  * crypto definitions and conversion tables
  */
 
 #define SALT_SIZE 16
+#define KNET_DATABUFSIZE_CRYPT KNET_DATABUFSIZE * 2
 
 enum crypto_crypt_t {
        CRYPTO_CIPHER_TYPE_NONE = 0,
@@ -98,8 +88,6 @@ struct crypto_instance {
        enum crypto_crypt_t crypto_cipher_type;
 
        enum crypto_hash_t crypto_hash_type;
-
-       unsigned int crypto_header_size;
 };
 
 /*
@@ -210,7 +198,7 @@ static int encrypt_nss(
 
        if (PK11_CipherOp(crypt_context, data,
                          &tmp1_outlen,
-                         KNET_FRAME_SIZE - instance->crypto_header_size,
+                         KNET_DATABUFSIZE_CRYPT,
                          (unsigned char *)buf_in, buf_in_len) != SECSuccess) {
                //log_printf(instance->log_level_security,
                //         "PK11_CipherOp failed (encrypt) crypt_type=%d (err %d)",
@@ -220,7 +208,7 @@ static int encrypt_nss(
        }
 
        if (PK11_DigestFinal(crypt_context, data + tmp1_outlen,
-                            &tmp2_outlen, KNET_FRAME_SIZE - tmp1_outlen) != SECSuccess) {
+                            &tmp2_outlen, KNET_DATABUFSIZE_CRYPT - tmp1_outlen) != SECSuccess) {
                //log_printf(instance->log_level_security,
                //         "PK11_DigestFinal failed (encrypt) crypt_type=%d (err %d)",
                //         (int)cipher_to_nss[instance->crypto_cipher_type],
@@ -255,7 +243,7 @@ static int decrypt_nss (
        unsigned char   *salt = buf;
        unsigned char   *data = salt + SALT_SIZE;
        int             datalen = *buf_len - SALT_SIZE;
-       unsigned char   outbuf[KNET_FRAME_SIZE];
+       unsigned char   outbuf[KNET_DATABUFSIZE_CRYPT];
        int             outbuf_len;
        int             err = -1;
 
@@ -540,27 +528,6 @@ static int authenticate_and_decrypt_nss (
  * exported API
  */
 
-size_t crypto_sec_header_size(
-       const char *crypto_cipher_type,
-       const char *crypto_hash_type)
-{
-       int crypto_cipher = string_to_crypto_cipher_type(crypto_cipher_type);
-       int crypto_hash = string_to_crypto_hash_type(crypto_hash_type);
-       size_t hdr_size = 0;
-
-       hdr_size = sizeof(struct crypto_config_header);
-
-       if (crypto_hash) {
-               hdr_size += hash_len[crypto_hash];
-       }
-
-       if (crypto_cipher) {
-               hdr_size += SALT_SIZE;
-               hdr_size += cypher_block_len[crypto_cipher];
-       }
-
-       return hdr_size;
-}
 
 int crypto_encrypt_and_sign (
        struct crypto_instance *instance,
@@ -569,60 +536,15 @@ int crypto_encrypt_and_sign (
        unsigned char *buf_out,
        size_t *buf_out_len)
 {
-       struct crypto_config_header *cch = (struct crypto_config_header *)buf_out;
-       int err;
-
-       cch->crypto_cipher_type = instance->crypto_cipher_type;
-       cch->crypto_hash_type = instance->crypto_hash_type;
-       cch->__pad0 = 0;
-       cch->__pad1 = 0;
-
-       buf_out += sizeof(struct crypto_config_header);
-
-       err = encrypt_and_sign_nss(instance,
+       return encrypt_and_sign_nss(instance,
                                   buf_in, buf_in_len,
                                   buf_out, buf_out_len);
-
-       *buf_out_len = *buf_out_len + sizeof(struct crypto_config_header);
-
-       return err;
 }
 
 int crypto_authenticate_and_decrypt (struct crypto_instance *instance,
        unsigned char *buf,
        int *buf_len)
 {
-       struct crypto_config_header *cch = (struct crypto_config_header *)buf;
-
-       /*
-        * decode crypto config of incoming packets
-        */
-
-       if (cch->crypto_cipher_type != instance->crypto_cipher_type) {
-               //log_printf(instance->log_level_security,
-               //         "Incoming packet has different crypto type. Rejecting");
-               return -1;
-       }
-
-       if (cch->crypto_hash_type != instance->crypto_hash_type) {
-               //log_printf(instance->log_level_security,
-               //         "Incoming packet has different hash type. Rejecting");
-               return -1;
-       }
-
-       if ((cch->__pad0 != 0) || (cch->__pad1 != 0)) {
-               //log_printf(instance->log_level_security,
-               //         "Incoming packet appears to have features not supported by this version of corosync. Rejecting");
-               return -1;
-       }
-
-       /*
-        * invalidate config header and kill it
-        */
-       cch = NULL;
-       *buf_len -= sizeof(struct crypto_config_header);
-       memmove(buf, buf + sizeof(struct crypto_config_header), *buf_len);
-
        return authenticate_and_decrypt_nss(instance, buf, buf_len);
 }
 
@@ -664,13 +586,23 @@ int crypto_init(
                    (knet_h->crypto_instance->private_key_len < 1024)) {
                        goto out_err;
                }
+
+               knet_h->tap_to_links_buf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
+               if (!knet_h->tap_to_links_buf_crypt)
+                       goto out_err;
+
+               knet_h->pingbuf_crypt = malloc(KNET_DATABUFSIZE_CRYPT);
+               if (!knet_h->pingbuf_crypt)
+                       goto out_err;
+
+       } else {
+               knet_h->tap_to_links_buf_crypt = (char *)knet_h->tap_to_links_buf;
+               knet_h->pingbuf_crypt = (char *)knet_h->pingbuf;
        }
 
        knet_h->crypto_instance->private_key = knet_handle_cfg->private_key;
        knet_h->crypto_instance->private_key_len = knet_handle_cfg->private_key_len;
 
-       knet_h->crypto_instance->crypto_header_size = crypto_sec_header_size(knet_handle_cfg->crypto_cipher_type, knet_handle_cfg->crypto_hash_type);
-
        if (init_nss(knet_h->crypto_instance) < 0) {
                goto out_err;
        }
@@ -678,8 +610,7 @@ int crypto_init(
        return 0;
 
 out_err:
-       free(knet_h->crypto_instance);
-       knet_h->crypto_instance = NULL;
+       crypto_fini(knet_h);
        return -1;
 }
 
@@ -691,9 +622,13 @@ void crypto_fini(
                        PK11_FreeSymKey(knet_h->crypto_instance->nss_sym_key);
                if (knet_h->crypto_instance->nss_sym_key_sign) 
                        PK11_FreeSymKey(knet_h->crypto_instance->nss_sym_key_sign);
+               if (knet_h->pingbuf_crypt != (char *)knet_h->pingbuf)
+                       free(knet_h->pingbuf_crypt);
+               if (knet_h->tap_to_links_buf_crypt != (char *)knet_h->tap_to_links_buf)
+                       free(knet_h->tap_to_links_buf_crypt);
                free(knet_h->crypto_instance);
                knet_h->crypto_instance = NULL;
        }
-       
+
        return;
 }

diff --git a/libknet/nsscrypto.h b/libknet/nsscrypto.h
index 124dbe5265ecf5df64e41ed50893dd88bf9bb930..38cd5711bccb0923d00ac5a886bc5c9c62aa41c4 100644 (file)
--- a/libknet/nsscrypto.h
+++ b/libknet/nsscrypto.h
@@ -6,10 +6,6 @@
 
 struct crypto_instance;
 
-size_t crypto_sec_header_size(
-       const char *crypto_cipher_type,
-       const char *crypto_hash_type);
-
 int crypto_authenticate_and_decrypt (
        struct crypto_instance *instance,
        unsigned char *buf,