From: Paolo Abeni <pabeni@redhat.com>
To: Ashwin Dayanand Kamat <kashwindayan@vmware.com>,
Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
linux-sctp@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: srivatsab@vmware.com, srivatsa@csail.mit.edu,
amakhalov@vmware.com, vsirnapalli@vmware.com, akaher@vmware.com
Subject: Re: [PATCH] sctp: Make sha1 as default algorithm if fips is enabled
Date: Thu, 22 Dec 2022 10:22:24 +0100 [thread overview]
Message-ID: <6209669358d038b30e5fe20ba571f93241b5248d.camel@redhat.com> (raw)
In-Reply-To: <1671513037-8958-1-git-send-email-kashwindayan@vmware.com>
On Tue, 2022-12-20 at 10:40 +0530, Ashwin Dayanand Kamat wrote:
> MD5 is not FIPS compliant. But still md5 was used as the default algorithm
> for sctp if fips was enabled.
> Due to this, listen() system call in ltp tests was failing for sctp
> in fips environment, with below error message.
>
> [ 6397.892677] sctp: failed to load transform for md5: -2
>
> Fix is to not assign md5 as default algorithm for sctp
> if fips_enabled is true. Instead make sha1 as default algorithm.
>
> Signed-off-by: Ashwin Dayanand Kamat <kashwindayan@vmware.com>
I don't know the fips standard in details, but it feel strange that you
get fips compliance _disabling_ the encryption. Can you please point
which part of the standard states it?
Since this is fix, you should also provide a suitable fixes tag. When
you will repost additionally include the target tree name (net) into
the subject, thanks!
> ---
> net/sctp/protocol.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
> index 909a89a..b6e9810 100644
> --- a/net/sctp/protocol.c
> +++ b/net/sctp/protocol.c
> @@ -34,6 +34,7 @@
> #include <linux/memblock.h>
> #include <linux/highmem.h>
> #include <linux/slab.h>
> +#include <linux/fips.h>
> #include <net/net_namespace.h>
> #include <net/protocol.h>
> #include <net/ip.h>
> @@ -1321,14 +1322,13 @@ static int __net_init sctp_defaults_init(struct net *net)
> /* Whether Cookie Preservative is enabled(1) or not(0) */
> net->sctp.cookie_preserve_enable = 1;
>
> - /* Default sctp sockets to use md5 as their hmac alg */
> -#if defined (CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5)
> - net->sctp.sctp_hmac_alg = "md5";
> -#elif defined (CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1)
> - net->sctp.sctp_hmac_alg = "sha1";
> -#else
> - net->sctp.sctp_hmac_alg = NULL;
> -#endif
> + /* Default sctp sockets to use md5 as default only if fips is not enabled */
> + if (!fips_enabled && IS_ENABLED(CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5))
> + net->sctp.sctp_hmac_alg = "md5";
> + else if (IS_ENABLED(CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1))
> + net->sctp.sctp_hmac_alg = "sha1";
> + else
> + net->sctp.sctp_hmac_alg = NULL;
It looks like the listener can still fail if fips mode is enabled after
that the netns is initialized. I think it would be better to take
action in sctp_listen_start() and buming a ratelimited notice the
selected hmac is changed due to fips.
Thanks,
Paolo
>
> /* Max.Burst - 4 */
> net->sctp.max_burst = SCTP_DEFAULT_MAX_BURST;
prev parent reply other threads:[~2022-12-22 9:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-20 5:10 [PATCH] sctp: Make sha1 as default algorithm if fips is enabled Ashwin Dayanand Kamat
2022-12-22 9:22 ` Paolo Abeni [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6209669358d038b30e5fe20ba571f93241b5248d.camel@redhat.com \
--to=pabeni@redhat.com \
--cc=akaher@vmware.com \
--cc=amakhalov@vmware.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kashwindayan@vmware.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=srivatsa@csail.mit.edu \
--cc=srivatsab@vmware.com \
--cc=vsirnapalli@vmware.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).