Bug 2034241
| Summary: | [TIPC] 'tipc node set key' failed on RHEL-8.6.0 | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Li Shuang <shuali> | |
| Component: | iproute | Assignee: | Andrea Claudi <aclaudi> | |
| Status: | CLOSED ERRATA | QA Contact: | Li Shuang <shuali> | |
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | 8.6 | CC: | jiji, lxin, network-qe | |
| Target Milestone: | rc | Keywords: | Regression, Triaged | |
| Target Release: | 8.7 | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | iproute-5.18.0-1.el8 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2085411 (view as bug list) | Environment: | ||
| Last Closed: | 2022-11-08 10:52:53 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2074607 | |||
| Bug Blocks: | ||||
TIPC encryption kernel support was introduced from kernel-4.18.0-267.el8, more details are in bz1893085. (In reply to Li Shuang from comment #1) > TIPC encryption kernel support was introduced from kernel-4.18.0-267.el8, > more details are in bz1893085. Correct me. master key for encryption and rekeying for encryption are introduced from rhel-8.4.0 kernel-4.18.0-267.el8 by bz1893085, but the encryption basic is introduced earlier, from rhel-8.3.0 kernel-4.18.0-197.el8 by bz1822129. On RHEL-8.4.0 ==> kernel-4.18.0-305.el8:
[root@ibm-x3650m4-05 ~]# modprobe tipc
[root@ibm-x3650m4-05 ~]# tipc bearer enable media eth dev eno2
[root@ibm-x3650m4-05 ~]# tipc node set key 0x1234567812345678123456781234567812345678
[root@ibm-x3650m4-05 ~]# ip addr show dev eno2
4: eno2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 6c:ae:8b:20:7b:ca brd ff:ff:ff:ff:ff:ff
inet 10.73.4.213/23 brd 10.73.5.255 scope global dynamic noprefixroute eno2
valid_lft 41168sec preferred_lft 41168sec
inet6 2620:52:0:4904:6eae:8bff:fe20:7bca/64 scope global dynamic noprefixroute
valid_lft 2591991sec preferred_lft 604791sec
inet6 fe80::6eae:8bff:fe20:7bca/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@ibm-x3650m4-05 ~]# uname -r
4.18.0-305.el8.x86_64
[root@ibm-x3650m4-05 ~]# rpm -q iproute
iproute-5.9.0-4.el8.x86_64
On RHEL-8.5.0 ==> kernel-4.18.0-348.el8:
[root@dell-per730-03 ~]# modprobe tipc
[root@dell-per730-03 ~]# tipc bearer enable media eth dev eno1
[root@dell-per730-03 ~]# tipc node set key 0x1234567812345678123456781234567812345678
[root@dell-per730-03 ~]# ip addr show dev eno1
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 44:a8:42:49:41:f4 brd ff:ff:ff:ff:ff:ff
inet 10.73.130.141/23 brd 10.73.131.255 scope global dynamic noprefixroute eno1
valid_lft 41036sec preferred_lft 41036sec
inet6 2620:52:0:4982:46a8:42ff:fe49:41f4/64 scope global dynamic noprefixroute
valid_lft 2591986sec preferred_lft 604786sec
inet6 fe80::46a8:42ff:fe49:41f4/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@dell-per730-03 ~]# uname -r
4.18.0-348.el8.x86_64
[root@dell-per730-03 ~]# rpm -q iproute
iproute-5.12.0-4.el8.x86_64
On RHEL-8.6.0-20220224.2 ==> kernel-4.18.0-367.el8:
[root@hp-dl380pg8-12 ~]# modprobe tipc
[root@hp-dl380pg8-12 ~]# tipc bearer enable media eth dev eno1
[root@hp-dl380pg8-12 ~]# tipc node set key 0x1234567812345678123456781234567812345678
error, invalid key input
[root@hp-dl380pg8-12 ~]# ip addr show dev eno1
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether a0:d3:c1:fb:bb:bc brd ff:ff:ff:ff:ff:ff
inet 10.73.130.145/23 brd 10.73.131.255 scope global dynamic noprefixroute eno1
valid_lft 41571sec preferred_lft 41571sec
inet6 2620:52:0:4982:a2d3:c1ff:fefb:bbbc/64 scope global dynamic noprefixroute
valid_lft 2591983sec preferred_lft 604783sec
inet6 fe80::a2d3:c1ff:fefb:bbbc/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@hp-dl380pg8-12 ~]# uname -r
4.18.0-367.el8.x86_64
[root@hp-dl380pg8-12 ~]# rpm -q iproute
iproute-5.15.0-3.el8.x86_64
I tried the following two upstream latest versions, it shows that no one is available for TIPC encryption settings. # git remote show origin * remote origin Fetch URL: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git Push URL: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git HEAD branch: main Remote branches: devlink-pr tracked flag-names tracked iproute2-4.1.x tracked main tracked net-next tracked Local branch configured for 'git pull': main merges with remote main Local ref configured for 'git push': main pushes to main (up to date) [root@hp-dl380pg8-12 ~]# modprobe tipc [root@hp-dl380pg8-12 ~]# tipc bearer enable media eth dev eno1 [root@hp-dl380pg8-12 ~]# tipc node set key 0x1234567812345678123456781234567812345678 error, invalid key input # git remote show origin * remote origin Fetch URL: https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git Push URL: https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git HEAD branch: main Remote branches: main tracked master tracked Local branch configured for 'git pull': main merges with remote main Local ref configured for 'git push': main pushes to main (up to date) [root@hp-dl380pg8-12 ~]# modprobe tipc [root@hp-dl380pg8-12 ~]# tipc bearer enable media eth dev eno1 [root@hp-dl380pg8-12 ~]# tipc node set key 0x1234567812345678123456781234567812345678 error, invalid key input (In reply to Li Shuang from comment #5) > [root@hp-dl380pg8-12 ~]# modprobe tipc > [root@hp-dl380pg8-12 ~]# tipc bearer enable media eth dev eno1 > [root@hp-dl380pg8-12 ~]# tipc node set key > 0x1234567812345678123456781234567812345678 > error, invalid key input It seems the check in str2key() is wrong for hex, we may need a fix like: diff --git a/tipc/misc.c b/tipc/misc.c index 909975d8..6175bf07 100644 --- a/tipc/misc.c +++ b/tipc/misc.c @@ -113,16 +113,15 @@ int str2key(char *str, struct tipc_aead_key *key) } } - if (len > TIPC_AEAD_KEYLEN_MAX) + key->keylen = ishex ? (len + 1) / 2 : len; + if (key->keylen > TIPC_AEAD_KEYLEN_MAX) return -1; /* Obtain key: */ if (!ishex) { - key->keylen = len; memcpy(key->key, str, len); } else { /* Convert hex string to key */ - key->keylen = (len + 1) / 2; for (i = 0; i < key->keylen; i++) { if (i == 0 && len % 2 != 0) { if (sscanf(str, "%1hhx", &key->key[0]) != 1) Thanks Xin, patch submitted upstream: https://patchwork.kernel.org/project/netdevbpf/patch/9e21220e872dc70dbcd8d4dcba38c3a607052d6e.1652435398.git.aclaudi@redhat.com/ Reproduce with iproute-5.15.0-4.el8.x86_64: # modprobe tipc # tipc bearer enable media eth dev eno1 # tipc node set key 0x1234567812345678123456781234567812345678 error, invalid key input # rmmod tipc Verified with iproute-5.18.0-1.el8.x86_64: # modprobe tipc # tipc bearer enable media eth dev eno1 # tipc node set key 0x1234567812345678123456781234567812345678 # rmmod tipc Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (iproute bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:7752 |
Description of problem: # modprobe tipc # ip netns exec tipc_c tipc node set key 0x1234567812345678123456781234567812345678 error, invalid key input AFAIK, the latest kernel support TIPC encryption features, but iproute on RHEL does not. I need TIPC encryption support with iproute as follows to do the testing. Merge branch 'tipc-encryption' into next Tuong Lien says: ==================== This series adds two new options in the 'iproute2/tipc' command, enabling users to use the new TIPC encryption features, i.e. the master key and rekeying which have been recently merged in kernel. The help menu of the "tipc node set key" command is also updated accordingly: # tipc node set key --help Usage: tipc node set key KEY [algname ALGNAME] [PROPERTIES] tipc node set key rekeying REKEYING KEY Symmetric KEY & SALT as a composite ASCII or hex string (0x...) in form: [KEY: 16, 24 or 32 octets][SALT: 4 octets] ALGNAME Cipher algorithm [default: "gcm(aes)"] PROPERTIES master - Set KEY as a cluster master key <empty> - Set KEY as a cluster key nodeid NODEID - Set KEY as a per-node key for own or peer REKEYING INTERVAL - Set rekeying interval (in minutes) [0: disable] now - Trigger one (first) rekeying immediately EXAMPLES tipc node set key this_is_a_master_key master tipc node set key 0x746869735F69735F615F6B657931365F73616C74 tipc node set key this_is_a_key16_salt algname "gcm(aes)" nodeid 1001002 tipc node set key rekeying 600 ==================== Signed-off-by: David Ahern <dsahern> Version-Release number of selected component (if applicable): # rpm -qf /usr/sbin/tipc iproute-5.15.0-1.el8.x86_64 # uname -r 4.18.0-355.el8.x86_64 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: