linux-kernel - [PATCH 9/9] Disable ccm and ccm4309 in fips mod

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141028175146.GA18467@bluepex.com>
Date:	Tue, 28 Oct 2014 15:51:54 -0200
From:	"Leonidas S. Barbosa" <leosilva@...ux.vnet.ibm.com>
To:	linux-crypto@...r.kernel.org,
	Herbert Xu <herbert@...dor.apana.org.au>,
	"David S. Miller" <davem@...emloft.net>
Cc:	linux-kernel@...r.kernel.org,
	Marcelo Henrique Cerri <mhcerri@...ux.vnet.ibm.com>,
	Fionnuala Gunter <fin@...ux.vnet.ibm.com>
Subject: [PATCH 9/9] Disable ccm and ccm4309 in fips mod

NX CCM has not support to keys larger than 128 neither our hardware.
In cases where a system is running in fips mode enabled a tcrypt test will
crash the system in a kernel panic call.
This patch disable, for now, CCM's algorithms in fips mode to avoid this.

Signed-off-by: Leonidas S. Barbosa <leosilva@...ux.vnet.ibm.com>
---
 drivers/crypto/nx/nx.c |   32 ++++++++++++++++++++++----------
 1 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
index aa8c38d..a32239c 100644
--- a/drivers/crypto/nx/nx.c
+++ b/drivers/crypto/nx/nx.c
@@ -35,6 +35,7 @@
 #include <linux/of.h>
 #include <asm/hvcall.h>
 #include <asm/vio.h>
+#include <linux/fips.h>
 
 #include "nx_csbcpb.h"
 #include "nx.h"
@@ -566,13 +567,15 @@ static int nx_register_algs(void)
 	if (rc)
 		goto out_unreg_gcm;
 
-	rc = crypto_register_alg(&nx_ccm_aes_alg);
-	if (rc)
-		goto out_unreg_gcm4106;
+	if (!fips_enabled) {
+		rc = crypto_register_alg(&nx_ccm_aes_alg);
+		if (rc)
+			goto out_unreg_gcm4106;
 
-	rc = crypto_register_alg(&nx_ccm4309_aes_alg);
-	if (rc)
-		goto out_unreg_ccm;
+		rc = crypto_register_alg(&nx_ccm4309_aes_alg);
+		if (rc)
+			goto out_unreg_ccm;
+	}
 
 	rc = crypto_register_shash(&nx_shash_sha256_alg);
 	if (rc)
@@ -593,9 +596,11 @@ out_unreg_s512:
 out_unreg_s256:
 	crypto_unregister_shash(&nx_shash_sha256_alg);
 out_unreg_ccm4309:
-	crypto_unregister_alg(&nx_ccm4309_aes_alg);
+	if (!fips_enabled)
+		crypto_unregister_alg(&nx_ccm4309_aes_alg);
 out_unreg_ccm:
-	crypto_unregister_alg(&nx_ccm_aes_alg);
+	if (fips_enabled)
+		crypto_unregister_alg(&nx_ccm_aes_alg);
 out_unreg_gcm4106:
 	crypto_unregister_alg(&nx_gcm4106_aes_alg);
 out_unreg_gcm:
@@ -746,8 +751,15 @@ static int nx_remove(struct vio_dev *viodev)
 	if (nx_driver.of.status == NX_OKAY) {
 		NX_DEBUGFS_FINI(&nx_driver);
 
-		crypto_unregister_alg(&nx_ccm_aes_alg);
-		crypto_unregister_alg(&nx_ccm4309_aes_alg);
+		/* CCM algorithm has not support to keys larger than 128
+		 * however tcrypt test uses key larger than. If a system
+		 * runs with fips enabled it'll crash. For now we need to
+		 * disable this two algorithms in fips mode.
+		 */
+		if (!fips_enabled) {
+			crypto_unregister_alg(&nx_ccm_aes_alg);
+			crypto_unregister_alg(&nx_ccm4309_aes_alg);
+		}
 		crypto_unregister_alg(&nx_gcm_aes_alg);
 		crypto_unregister_alg(&nx_gcm4106_aes_alg);
 		crypto_unregister_alg(&nx_ctr_aes_alg);
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/