Bug 1702303 - Enable enable fips-mode-rchecksum for new volumes by default
Summary: Enable enable fips-mode-rchecksum for new volumes by default
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: GlusterFS
Classification: Community
Component: glusterd
Version: mainline
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Ravishankar N
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1706683
TreeView+ depends on / blocked
 
Reported: 2019-04-23 12:52 UTC by Ravishankar N
Modified: 2019-05-06 04:08 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1706683 (view as bug list)
Environment:
Last Closed: 2019-04-26 08:23:27 UTC
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Gluster.org Gerrit 22609 0 None Merged glusterd: enable fips-mode-rchecksum for new volumes 2019-04-26 08:23:26 UTC

Description Ravishankar N 2019-04-23 12:52:39 UTC
Description of problem:

fips-mode-rchecksum option was provided in GD_OP_VERSION_4_0_0 to maintain backward compatibility with older AFR so that a cluster operating at an op version of less than GD_OP_VERSION_4_0_0 used MD5SUM instead of the SHA256 that would be used if this option was enabled.

But in a freshly created setup with cluster op-version >=GD_OP_VERSION_4_0_0, we can directly go ahead and use SHA256 without asking the admin to explicitly set the volume option 'on'. 

In fact in downstream, this created quite a bit of confusion when QE would created a new glusterfs setup on a FIPS enabled machine and would try out self-heal test cases (without setting 'fips-mode-rchecksum'  on), leading to crashes due to non-compliance. Ideally this fix should have been done as a part of the original commit: "6daa65356 - posix/afr: handle backward compatibility for rchecksum fop" but I guess it is better late than never.

Comment 1 Worker Ant 2019-04-23 12:56:14 UTC
REVIEW: https://review.gluster.org/22609 (glusterd: enable fips-mode-rchecksum for new volumes) posted (#1) for review on master by Ravishankar N

Comment 2 Worker Ant 2019-04-26 08:23:27 UTC
REVIEW: https://review.gluster.org/22609 (glusterd: enable fips-mode-rchecksum for new volumes) merged (#4) on master by Atin Mukherjee


Note You need to log in before you can comment on or make changes to this bug.