Bug 1634710
| Summary: | Unable to start corosync with error message: Unable to encrypt authkey... | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Miroslav Lisik <mlisik> | ||||
| Component: | corosync | Assignee: | Jan Friesse <jfriesse> | ||||
| Status: | CLOSED ERRATA | QA Contact: | cluster-qe <cluster-qe> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 7.6 | CC: | ccaulfie, cluster-maint, mmazoure | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | corosync-2.4.3-5.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-08-06 13:10:11 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
This bug is because of patch adding "FIPS" compliant method of importing private key. Solution is currently waiting for review (https://github.com/corosync/corosync/pull/383 resp. https://github.com/kronosnet/kronosnet/pull/159). Created attachment 1535913 [details]
totemcrypto: Fix importing of the private key
totemcrypto: Fix importing of the private key
Import key with length not dividable by wrap key block size was not
possible.
Wrapping of the key is standard crypto operation which needs data
aligned to cipher block size, otherwise it fails.
Possible solution is to use a zero filled buffer with size aligned to
required wrap key block size. Private key is copied to the beginning of
the buffer and unwrap operation keeps using only required private key
size.
Signed-off-by: Jan Friesse <jfriesse>
Reviewed-by: Fabio M. Di Nitto <fdinitto>
Reviewed-by: Christine Caulfield <ccaulfie>
BEFORE (corosync-2.4.3-4.el7) ====== 1. Create cluster and authenticate its nodes without starting it ## On every node # passwd hacluster Changing password for user hacluster. New password: Retype new password: passwd: all authentication tokens updated successfully. # systemctl start pcsd.service # systemctl enable pcsd.service ## From one node [root@host-026 ~]# pcs cluster auth host-026 host-027 host-028 Username: hacluster Password: host-027: Authorized host-026: Authorized host-028: Authorized [root@host-026 ~]# pcs cluster setup --name STSRHTS8178 host-026 host-027 host-028 ... 2. Replacing option in corosync.conf [root@host-026 ~]# sed -i "s/secauth: off/key: _NOT_SECRET--_OqZhxLnNcFVs5y07ldcuhU74j-kOr_vqqx_XnySCt0/" /etc/corosync/corosync.conf 3. Trying to start corosync [root@host-026 ~]# pcs cluster start Starting Cluster (corosync)... Job for corosync.service failed because the control process exited with error code. See "systemctl status corosync.service" and "journalctl -xe" for details. Error: unable to start corosync [root@host-026 ~]# echo $? 1 AFTER (corosync-2.4.3-6.el7) ===== 1. Create cluster and authenticate its nodes without starting it ... 2. Replacing option in corosync.conf ... 3. Trying to start corosync [root@host-026 ~]# pcs cluster start Starting Cluster (corosync)... Starting Cluster (pacemaker)... [root@host-026 ~]# echo $? 0 RESULT ====== Before the fix corosync didn't start with 'key' option in corosync.conf. Now it works without any problems. Verified for version corosync-2.4.3-6.el7 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2245 |
Description of problem: Unable to start corosync after setting the key option with an encryption key in corosync.conf. Corosync failed to start with error message: [TOTEM ] Unable to encrypt authkey (-8187): security library: invalid arguments. Version-Release number of selected component (if applicable): corosync-2.4.3-4.el7 How reproducible: always Steps to Reproduce: 1. Create cluster with pcs and don't start it. NOTE: cluster nodes are already authenticated [root@virt-149 ~]# pcs cluster setup --name STSRHTS8178 virt-133 virt-148 virt-149 ... 2. in corosync.conf generated by pcs replace option: secauth: off with key: _NOT_SECRET--_OqZhxLnNcFVs5y07ldcuhU74j-kOr_vqqx_XnySCt0 [root@virt-149 ~]# sed -i "s/secauth: off/key: _NOT_SECRET--_OqZhxLnNcFVs5y07ldcuhU74j-kOr_vqqx_XnySCt0/" /etc/corosync/corosync.conf [root@virt-149 ~]# cat /etc/corosync/corosync.conf totem { version: 2 cluster_name: STSRHTS8178 key: _NOT_SECRET--_OqZhxLnNcFVs5y07ldcuhU74j-kOr_vqqx_XnySCt0 transport: udpu } nodelist { node { ring0_addr: virt-133 nodeid: 1 } node { ring0_addr: virt-148 nodeid: 2 } node { ring0_addr: virt-149 nodeid: 3 } } quorum { provider: corosync_votequorum } logging { to_logfile: yes logfile: /var/log/cluster/corosync.log to_syslog: yes } 3. Try to start corosync on one node [root@virt-149 ~]# pcs cluster start Starting Cluster (corosync)... Job for corosync.service failed because the control process exited with error code. See "systemctl status corosync.service" and "journalctl -xe" for details. Error: unable to start corosync 4. Check the logs /var/log/messages: Oct 1 13:14:08 virt-149 systemd: Starting Corosync Cluster Engine... Oct 1 13:14:08 virt-149 corosync[29882]: [MAIN ] Corosync Cluster Engine ('2.4.3'): started and ready to provide service. Oct 1 13:14:08 virt-149 corosync[29882]: [MAIN ] Corosync built-in features: dbus systemd xmlconf qdevices qnetd snmp libcgroup pie relro bindnow Oct 1 13:14:08 virt-149 corosync[29883]: [TOTEM ] Initializing transport (UDP/IP Unicast). Oct 1 13:14:08 virt-149 corosync[29883]: [TOTEM ] Initializing transmit/receive security (NSS) crypto: aes256 hash: sha1 Oct 1 13:14:08 virt-149 corosync[29883]: [TOTEM ] Unable to encrypt authkey (-8187): security library: invalid arguments. Oct 1 13:14:08 virt-149 corosync[29883]: [MAIN ] Can't initialize TOTEM layer Oct 1 13:14:08 virt-149 corosync[29883]: [MAIN ] Corosync Cluster Engine exiting with status 15 at main.c:1517. Oct 1 13:15:09 virt-149 corosync: Starting Corosync Cluster Engine (corosync): [FAILED] Oct 1 13:15:09 virt-149 systemd: corosync.service: control process exited, code=exited status=1 Oct 1 13:15:09 virt-149 systemd: Failed to start Corosync Cluster Engine. Oct 1 13:15:09 virt-149 systemd: Unit corosync.service entered failed state. Oct 1 13:15:09 virt-149 systemd: corosync.service failed. Actual results: Corosync does not start if option 'key' is set in corosync.conf Expected results: Corosync starts if option 'key' is set in corosync.conf Additional info: Also reproducible in RHEL 7.5