Skip to content

Commit d4e0672

Browse files
kuba-mookuba-moo
committed
Merge branch 'check-if-fips-mode-is-enabled-when-running-selftests'
Magali Lemes says: ==================== Check if FIPS mode is enabled when running selftests Some test cases from net/tls, net/fcnal-test and net/vrf-xfrm-tests that rely on cryptographic functions to work and use non-compliant FIPS algorithms fail in FIPS mode. In order to allow these tests to pass in a wider set of kernels, - for net/tls, skip the test variants that use the ChaCha20-Poly1305 and SM4 algorithms, when FIPS mode is enabled; - for net/fcnal-test, skip the MD5 tests, when FIPS mode is enabled; - for net/vrf-xfrm-tests, replace the algorithms that are not FIPS-compliant with compliant ones. v1: https://lore.kernel.org/netdev/20230607174302.19542-1-magali.lemes@canonical.com/ v2: https://lore.kernel.org/netdev/20230609164324.497813-1-magali.lemes@canonical.com/ v3: https://lore.kernel.org/netdev/20230612125107.73795-1-magali.lemes@canonical.com/ ==================== Link: https://lore.kernel.org/r/20230613123222.631897-1-magali.lemes@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents 40f71e7 + d7a2fc1 commit d4e0672

File tree

4 files changed

+61
-28
lines changed

4 files changed

+61
-28
lines changed

‎tools/testing/selftests/kselftest_harness.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@
249249

250250
/**
251251
* FIXTURE_SETUP() - Prepares the setup function for the fixture.
252-
* *_metadata* is included so that EXPECT_* and ASSERT_* work correctly.
252+
* *_metadata* is included so that EXPECT_*, ASSERT_* etc. work correctly.
253253
*
254254
* @fixture_name: fixture name
255255
*
@@ -275,7 +275,7 @@
275275

276276
/**
277277
* FIXTURE_TEARDOWN()
278-
* *_metadata* is included so that EXPECT_* and ASSERT_* work correctly.
278+
* *_metadata* is included so that EXPECT_*, ASSERT_* etc. work correctly.
279279
*
280280
* @fixture_name: fixture name
281281
*
@@ -388,7 +388,7 @@
388388
if (setjmp(_metadata->env) == 0) { \
389389
fixture_name##_setup(_metadata, &self, variant->data); \
390390
/* Let setup failure terminate early. */ \
391-
if (!_metadata->passed) \
391+
if (!_metadata->passed || _metadata->skip) \
392392
return; \
393393
_metadata->setup_completed = true; \
394394
fixture_name##_##test_name(_metadata, &self, variant->data); \

‎tools/testing/selftests/net/fcnal-test.sh‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,13 @@ NSC_CMD="ip netns exec ${NSC}"
9292

9393
which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)
9494

95+
# Check if FIPS mode is enabled
96+
if [ -f /proc/sys/crypto/fips_enabled ]; then
97+
fips_enabled=`cat /proc/sys/crypto/fips_enabled`
98+
else
99+
fips_enabled=0
100+
fi
101+
95102
################################################################################
96103
# utilities
97104

@@ -1216,7 +1223,7 @@ ipv4_tcp_novrf()
12161223
run_cmd nettest -d ${NSA_DEV} -r ${a}
12171224
log_test_addr ${a} $? 1 "No server, device client, local conn"
12181225

1219-
ipv4_tcp_md5_novrf
1226+
[ "$fips_enabled" = "1" ] || ipv4_tcp_md5_novrf
12201227
}
12211228

12221229
ipv4_tcp_vrf()
@@ -1270,9 +1277,11 @@ ipv4_tcp_vrf()
12701277
log_test_addr ${a} $? 1 "Global server, local connection"
12711278

12721279
# run MD5 tests
1273-
setup_vrf_dup
1274-
ipv4_tcp_md5
1275-
cleanup_vrf_dup
1280+
if [ "$fips_enabled" = "0" ]; then
1281+
setup_vrf_dup
1282+
ipv4_tcp_md5
1283+
cleanup_vrf_dup
1284+
fi
12761285

12771286
#
12781287
# enable VRF global server
@@ -2772,7 +2781,7 @@ ipv6_tcp_novrf()
27722781
log_test_addr ${a} $? 1 "No server, device client, local conn"
27732782
done
27742783

2775-
ipv6_tcp_md5_novrf
2784+
[ "$fips_enabled" = "1" ] || ipv6_tcp_md5_novrf
27762785
}
27772786

27782787
ipv6_tcp_vrf()
@@ -2842,9 +2851,11 @@ ipv6_tcp_vrf()
28422851
log_test_addr ${a} $? 1 "Global server, local connection"
28432852

28442853
# run MD5 tests
2845-
setup_vrf_dup
2846-
ipv6_tcp_md5
2847-
cleanup_vrf_dup
2854+
if [ "$fips_enabled" = "0" ]; then
2855+
setup_vrf_dup
2856+
ipv6_tcp_md5
2857+
cleanup_vrf_dup
2858+
fi
28482859

28492860
#
28502861
# enable VRF global server

‎tools/testing/selftests/net/tls.c‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@
2525
#define TLS_PAYLOAD_MAX_LEN 16384
2626
#define SOL_TLS 282
2727

28+
static int fips_enabled;
29+
2830
struct tls_crypto_info_keys {
2931
union {
3032
struct tls12_crypto_info_aes_gcm_128 aes128;
@@ -235,7 +237,7 @@ FIXTURE_VARIANT(tls)
235237
{
236238
uint16_t tls_version;
237239
uint16_t cipher_type;
238-
bool nopad;
240+
bool nopad, fips_non_compliant;
239241
};
240242

241243
FIXTURE_VARIANT_ADD(tls, 12_aes_gcm)
@@ -254,24 +256,28 @@ FIXTURE_VARIANT_ADD(tls, 12_chacha)
254256
{
255257
.tls_version = TLS_1_2_VERSION,
256258
.cipher_type = TLS_CIPHER_CHACHA20_POLY1305,
259+
.fips_non_compliant = true,
257260
};
258261

259262
FIXTURE_VARIANT_ADD(tls, 13_chacha)
260263
{
261264
.tls_version = TLS_1_3_VERSION,
262265
.cipher_type = TLS_CIPHER_CHACHA20_POLY1305,
266+
.fips_non_compliant = true,
263267
};
264268

265269
FIXTURE_VARIANT_ADD(tls, 13_sm4_gcm)
266270
{
267271
.tls_version = TLS_1_3_VERSION,
268272
.cipher_type = TLS_CIPHER_SM4_GCM,
273+
.fips_non_compliant = true,
269274
};
270275

271276
FIXTURE_VARIANT_ADD(tls, 13_sm4_ccm)
272277
{
273278
.tls_version = TLS_1_3_VERSION,
274279
.cipher_type = TLS_CIPHER_SM4_CCM,
280+
.fips_non_compliant = true,
275281
};
276282

277283
FIXTURE_VARIANT_ADD(tls, 12_aes_ccm)
@@ -311,6 +317,9 @@ FIXTURE_SETUP(tls)
311317
int one = 1;
312318
int ret;
313319

320+
if (fips_enabled && variant->fips_non_compliant)
321+
SKIP(return, "Unsupported cipher in FIPS mode");
322+
314323
tls_crypto_info_init(variant->tls_version, variant->cipher_type,
315324
&tls12);
316325

@@ -1865,4 +1874,17 @@ TEST(prequeue) {
18651874
close(cfd);
18661875
}
18671876

1877+
static void __attribute__((constructor)) fips_check(void) {
1878+
int res;
1879+
FILE *f;
1880+
1881+
f = fopen("/proc/sys/crypto/fips_enabled", "r");
1882+
if (f) {
1883+
res = fscanf(f, "%d", &fips_enabled);
1884+
if (res != 1)
1885+
ksft_print_msg("ERROR: Couldn't read /proc/sys/crypto/fips_enabled\n");
1886+
fclose(f);
1887+
}
1888+
}
1889+
18681890
TEST_HARNESS_MAIN

‎tools/testing/selftests/net/vrf-xfrm-tests.sh‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -264,60 +264,60 @@ setup_xfrm()
264264
ip -netns host1 xfrm state add src ${HOST1_4} dst ${HOST2_4} \
265265
proto esp spi ${SPI_1} reqid 0 mode tunnel \
266266
replay-window 4 replay-oseq 0x4 \
267-
auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
268-
enc 'cbc(des3_ede)' ${ENC_1} \
267+
auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
268+
enc 'cbc(aes)' ${ENC_1} \
269269
sel src ${h1_4} dst ${h2_4} ${devarg}
270270

271271
ip -netns host2 xfrm state add src ${HOST1_4} dst ${HOST2_4} \
272272
proto esp spi ${SPI_1} reqid 0 mode tunnel \
273273
replay-window 4 replay-oseq 0x4 \
274-
auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
275-
enc 'cbc(des3_ede)' ${ENC_1} \
274+
auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
275+
enc 'cbc(aes)' ${ENC_1} \
276276
sel src ${h1_4} dst ${h2_4}
277277

278278

279279
ip -netns host1 xfrm state add src ${HOST2_4} dst ${HOST1_4} \
280280
proto esp spi ${SPI_2} reqid 0 mode tunnel \
281281
replay-window 4 replay-oseq 0x4 \
282-
auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
283-
enc 'cbc(des3_ede)' ${ENC_2} \
282+
auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
283+
enc 'cbc(aes)' ${ENC_2} \
284284
sel src ${h2_4} dst ${h1_4} ${devarg}
285285

286286
ip -netns host2 xfrm state add src ${HOST2_4} dst ${HOST1_4} \
287287
proto esp spi ${SPI_2} reqid 0 mode tunnel \
288288
replay-window 4 replay-oseq 0x4 \
289-
auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
290-
enc 'cbc(des3_ede)' ${ENC_2} \
289+
auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
290+
enc 'cbc(aes)' ${ENC_2} \
291291
sel src ${h2_4} dst ${h1_4}
292292

293293

294294
ip -6 -netns host1 xfrm state add src ${HOST1_6} dst ${HOST2_6} \
295295
proto esp spi ${SPI_1} reqid 0 mode tunnel \
296296
replay-window 4 replay-oseq 0x4 \
297-
auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
298-
enc 'cbc(des3_ede)' ${ENC_1} \
297+
auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
298+
enc 'cbc(aes)' ${ENC_1} \
299299
sel src ${h1_6} dst ${h2_6} ${devarg}
300300

301301
ip -6 -netns host2 xfrm state add src ${HOST1_6} dst ${HOST2_6} \
302302
proto esp spi ${SPI_1} reqid 0 mode tunnel \
303303
replay-window 4 replay-oseq 0x4 \
304-
auth-trunc 'hmac(md5)' ${AUTH_1} 96 \
305-
enc 'cbc(des3_ede)' ${ENC_1} \
304+
auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \
305+
enc 'cbc(aes)' ${ENC_1} \
306306
sel src ${h1_6} dst ${h2_6}
307307

308308

309309
ip -6 -netns host1 xfrm state add src ${HOST2_6} dst ${HOST1_6} \
310310
proto esp spi ${SPI_2} reqid 0 mode tunnel \
311311
replay-window 4 replay-oseq 0x4 \
312-
auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
313-
enc 'cbc(des3_ede)' ${ENC_2} \
312+
auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
313+
enc 'cbc(aes)' ${ENC_2} \
314314
sel src ${h2_6} dst ${h1_6} ${devarg}
315315

316316
ip -6 -netns host2 xfrm state add src ${HOST2_6} dst ${HOST1_6} \
317317
proto esp spi ${SPI_2} reqid 0 mode tunnel \
318318
replay-window 4 replay-oseq 0x4 \
319-
auth-trunc 'hmac(md5)' ${AUTH_2} 96 \
320-
enc 'cbc(des3_ede)' ${ENC_2} \
319+
auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \
320+
enc 'cbc(aes)' ${ENC_2} \
321321
sel src ${h2_6} dst ${h1_6}
322322
}
323323

0 commit comments

Comments
 (0)