crypto: Support for knet_get_crypto_cipher_list

Similar to the crypto model and compress model, use
knet_get_crypto_cipher_list (if available) to get the list
of allowed crypto ciphers.

For older versions of knet, a hardcoded list (identical to what was
defined in coroparse.c) is used.

The list is displayed in the corosync -v output and used by
coroparse.c.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>

configure.ac

@@ -189,6 +189,8 @@ AC_CHECK_LIB([knet],[knet_handle_get_onwire_ver],
 	     [AC_DEFINE_UNQUOTED([HAVE_KNET_ONWIRE_VER], 1, [have knet onwire versioning])])
 AC_CHECK_LIB([knet],[knet_handle_setprio_dscp],
 	     [AC_DEFINE_UNQUOTED([HAVE_KNET_SETPRIO_DSCP], 1, [have knet dscp traffic prioritization])])
+AC_CHECK_LIB([knet],[knet_get_crypto_cipher_list],
+	     [AC_DEFINE_UNQUOTED([HAVE_KNET_GET_CRYPTO_CIPHER_LIST], 1, [have knet get crypto cipher list])])
 LIBS="$OLDLIBS"
 
 # Checks for library functions.

exec/coroparse.c

@@ -614,6 +614,18 @@ static int handle_crypto_model(const char *val, const char **error_string)
 	}
 }
 
+static int handle_crypto_cipher(const char *val, const char **error_string)
+{
+
+	if (util_is_valid_knet_crypto_cipher(val, NULL, 0,
+	    "Invalid cipher type. Should be ", error_string) == 1) {
+		return (0);
+	} else {
+		return (-1);
+	}
+}
+
+
 static int handle_compress_model(const char *val, const char **error_string)
 {
 
@@ -846,13 +858,7 @@ static int main_config_parser_cb(const char *path,
 			}
 
 			if (strcmp(path, "totem.crypto_cipher") == 0) {
-				if ((strcmp(value, "none") != 0) &&
-				    (strcmp(value, "aes256") != 0) &&
-				    (strcmp(value, "aes192") != 0) &&
-				    (strcmp(value, "aes128") != 0)) {
-					*error_string = "Invalid cipher type. "
-					    "Should be none, aes256, aes192 or aes128";
-
+				if (handle_crypto_cipher(value, error_string) != 0) {
 					return (0);
 				}
 			}

exec/main.c

@@ -1255,6 +1255,12 @@ static void show_version_info_crypto(void)
 	} else {
 		perror(error_string);
 	}
+
+	if (util_is_valid_knet_crypto_cipher(NULL, &list_str, 1, "", &error_string) != -1) {
+		printf("Available crypto ciphers: %s\n", list_str);
+	} else {
+		perror(error_string);
+	}
 }
 
 static void show_version_info_compress(void)

exec/util.c

@@ -350,6 +350,54 @@ int util_is_valid_knet_compress_model(const char *val,
 	    machine_parseable_str, error_string_prefix, error_string));
 }
 
+/*
+ * Similar to util_is_valid_knet_crypto_model
+ */
+int util_is_valid_knet_crypto_cipher(const char *val,
+	const char **list_str, int machine_parseable_str,
+	const char *error_string_prefix, const char **error_string)
+{
+	const char *items[UTILS_IS_VALID_KNET_LIST_MAX_ITEMS];
+	size_t items_out_idx = 0;
+#ifdef HAVE_KNET_GET_CRYPTO_CIPHER_LIST
+	size_t entries;
+	size_t zi;
+	struct knet_crypto_cipher_info crypto_cipher_list[UTILS_IS_VALID_KNET_LIST_MAX_ITEMS];
+#endif
+
+#ifdef ENABLE_UNENCRYPTED
+	items[items_out_idx++] = "none";
+#endif
+
+#ifdef HAVE_KNET_GET_CRYPTO_CIPHER_LIST
+	if (knet_get_crypto_cipher_list(NULL, &entries) != 0) {
+		*error_string = "internal error - cannot get crypto cipher list";
+		return (-1);
+	}
+
+	if (entries > (sizeof(crypto_cipher_list) / sizeof(crypto_cipher_list[0])) - items_out_idx) {
+		*error_string = "internal error - too many knet crypto cipher list entries";
+		return (-1);
+	}
+
+	if (knet_get_crypto_cipher_list(crypto_cipher_list, &entries) != 0) {
+		*error_string = "internal error - cannot get knet crypto cipher list";
+		return (-1);
+	}
+
+	for (zi = 0; zi < entries; zi++) {
+		items[items_out_idx++] = crypto_cipher_list[zi].name;
+	}
+#else
+	items[items_out_idx++] = "aes256";
+	items[items_out_idx++] = "aes192";
+	items[items_out_idx++] = "aes128";
+#endif
+
+	return (util_is_valid_knet_list_helper(val, items, items_out_idx, list_str,
+	    machine_parseable_str, error_string_prefix, error_string));
+}
+
 int
 set_socket_dscp(int socket, unsigned char dscp)
 {

exec/util.h

@@ -95,6 +95,10 @@ extern int util_is_valid_knet_compress_model(const char *val,
 	const char **list_str, int machine_parseable_str,
 	const char *error_string_prefix, const char **error_string);
 
+extern int util_is_valid_knet_crypto_cipher(const char *val,
+	const char **list_str, int machine_parseable_str,
+	const char *error_string_prefix, const char **error_string);
+
 int set_socket_dscp(int socket, unsigned char dscp);
 
 #endif /* UTIL_H_DEFINED */