linux-kernel - [PATCH net v2 0/3] Check if FIPS mode is enabled when running selftests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230609164324.497813-1-magali.lemes@canonical.com>
Date:   Fri,  9 Jun 2023 13:43:21 -0300
From:   Magali Lemes <magali.lemes@...onical.com>
To:     davem@...emloft.net, dsahern@...il.com, edumazet@...gle.com,
        kuba@...nel.org, pabeni@...hat.com, shuah@...nel.org,
        tianjia.zhang@...ux.alibaba.com, vfedorenko@...ek.ru
Cc:     andrei.gherzan@...onical.com, linux-kernel@...r.kernel.org,
        linux-kselftest@...r.kernel.org, netdev@...r.kernel.org
Subject: [PATCH net v2 0/3] Check if FIPS mode is enabled when running selftests

Some test cases from net/tls, net/fcnal-test and net/vrf-xfrm-tests
that rely on cryptographic functions to work and use non-compliant FIPS
algorithms fail in FIPS mode.

In order to allow these tests to pass in a wider set of kernels,
 - for net/tls, skip the test variants that use the ChaCha20-Poly1305
and SM4 algorithms, when FIPS mode is enabled;
 - for net/fcnal-test, skip the MD5 tests, when FIPS mode is enabled;
 - for net/vrf-xfrm-tests, replace the algorithms that are not
FIPS-compliant with compliant ones.

Changes in v2:
 - Add R-b tags.
 - Put fips_non_compliant into the variants.
 - Turn fips_enabled into a static global variable.
 - Read /proc/sys/crypto/fips_enabled only once at main().

v1: https://lore.kernel.org/netdev/20230607174302.19542-1-magali.lemes@canonical.com/

Magali Lemes (3):
  selftests: net: tls: check if FIPS mode is enabled
  selftests: net: vrf-xfrm-tests: change authentication and encryption
    algos
  selftests: net: fcnal-test: check if FIPS mode is enabled

 tools/testing/selftests/net/fcnal-test.sh     |  27 ++-
 tools/testing/selftests/net/tls.c             | 175 +++++++++++++++++-
 tools/testing/selftests/net/vrf-xfrm-tests.sh |  32 ++--
 3 files changed, 209 insertions(+), 25 deletions(-)

-- 
2.34.1