Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libgcrypt is initialized even for configurations that don't use it #1902

Closed
arader opened this issue Aug 29, 2016 · 1 comment
Closed

libgcrypt is initialized even for configurations that don't use it #1902

arader opened this issue Aug 29, 2016 · 1 comment
Labels
Bug A genuine bug
Milestone

Comments

@arader
Copy link

arader commented Aug 29, 2016

  • Version of collectd: 5.5.2
  • Operating system / distribution: FreeBSD 10.3

Expected behavior

In my configuration I don't enable any crypto for the Network plugin:

<Plugin network>
    Server "10.0.1.21" "8096"
</Plugin>

As such, I expect libgcrypt to not be initialized at all.

Actual behavior

It appears that despite my config libgcrypt is still being initialized. This was discovered because I ran into issue #1870 which was causing collectd to crash.

Steps to reproduce

  • Configure collectd's network plugin as above
  • Start collectd, notice that libgcrypt is initialized

For more context, see @rubenk's comment here: #1870 (comment)

@octo
Copy link
Member

octo commented Sep 2, 2016

I can confirm that network_init_gcrypt() is called unconditionally from network_init(). I think this call can be removed, because gcrypt is (conditionally) initialized during the configuration phase:

  • Both, network_config_add_listen() and network_config_add_server() unconditionally call sockent_init_crypto().
  • sockent_init_crypto() calls network_init_gcrypt() only if the socket has security enabled.

The call in network_init() only has any effect, if a server is configured with:

SecurityLevel none
AuthFile "/some/path"

This config does not require clients to encrypt packets, but makes it possible to decrypt packets.

I think we can do the following change:

  • Call network_gcrypt_init() from sockent_init_crypto() when a server socket has a non-NULL auth_file (instead of looking at the security level setting). There is a separate check that complains if auth_file is NULL and the security level is not NONE.
  • Remove the network_gcrypt_init() call from network_init().

@octo octo added this to the 5.5 milestone Sep 2, 2016
@octo octo added the Bug A genuine bug label Sep 2, 2016
@octo octo closed this as completed in 22b9f54 Sep 2, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug A genuine bug
Projects
None yet
Development

No branches or pull requests

2 participants