phosphor-ipmi-net: allow HMAC SHA1
This is needed for cipher suite 3 to work.
Tested: Built and inspected phosphor-ipmi-net source
Google-Bug-Id: 232026250
Google-Bug-Id: 331878751
Fusion-Link: fusion2/a1b6a6dc-b0db-3ffa-a7cf-d349a785173f
Change-Id: Icebb8460a7da7945a96672e681a67f852a1976b1
Signed-off-by: Benjamin Fair <benjaminfair@google.com>
diff --git a/recipes-phosphor/ipmi/phosphor-ipmi-net/0001-Revert-Remove-HMAC-SHA1-from-Authentication-Integrit.patch b/recipes-phosphor/ipmi/phosphor-ipmi-net/0001-Revert-Remove-HMAC-SHA1-from-Authentication-Integrit.patch
new file mode 100644
index 0000000..38af217
--- /dev/null
+++ b/recipes-phosphor/ipmi/phosphor-ipmi-net/0001-Revert-Remove-HMAC-SHA1-from-Authentication-Integrit.patch
@@ -0,0 +1,52 @@
+From 6897664010abed19871e036c48441b54df32aab4 Mon Sep 17 00:00:00 2001
+From: Drew Macrae <drewmacrae@google.com>
+Date: Thu, 5 Nov 2020 15:20:18 -0800
+Subject: [PATCH 1/1] Revert "Remove HMAC-SHA1 from Authentication/Integrity
+ Alg"
+
+This reverts commit 4c494398a36d9f1bdc4f256f937487c7ebcc4e95.
+
+Patch Tracking Bug: b/232026250
+Upstream info / review: N/A
+Upstream-Status: Inappropriate [bugfix b/226803478]
+Justification: We want to move to cipher suite 17 which is SHA256 only.
+However, we found that ipmitool still used cipher suite 3 by default.
+We are tracking ipmitool issue in b/226803478 and will remove this patch
+once the fix is deployed to ipmitool/gsys.
+
+---
+ auth_algo.hpp | 3 ++-
+ integrity_algo.hpp | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/auth_algo.hpp b/auth_algo.hpp
+index 894a853..24e4ff3 100644
+--- a/auth_algo.hpp
++++ b/auth_algo.hpp
+@@ -107,7 +107,8 @@ class Interface
+ */
+ static bool isAlgorithmSupported(Algorithms algo)
+ {
+- if (algo == Algorithms::RAKP_HMAC_SHA256)
++ if (algo == Algorithms::RAKP_HMAC_SHA1 ||
++ algo == Algorithms::RAKP_HMAC_SHA256)
+ {
+ return true;
+ }
+diff --git a/integrity_algo.hpp b/integrity_algo.hpp
+index cdeb617..d8c9f5a 100644
+--- a/integrity_algo.hpp
++++ b/integrity_algo.hpp
+@@ -93,7 +93,8 @@ class Interface
+ */
+ static bool isAlgorithmSupported(Algorithms algo)
+ {
+- if (algo == Algorithms::HMAC_SHA256_128)
++ if (algo == Algorithms::HMAC_SHA1_96 ||
++ algo == Algorithms::HMAC_SHA256_128)
+ {
+ return true;
+ }
+--
+2.29.1.341.ge80a0c044ae-goog
+
diff --git a/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend b/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
index 79d98b4..4407615 100644
--- a/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
+++ b/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
@@ -2,3 +2,6 @@
EXTRA_OEMESON:append = " -Dpam_authenticate=disabled"
+SRC_URI += " \
+ file://0001-Revert-Remove-HMAC-SHA1-from-Authentication-Integrit.patch \
+"
