[OS-BUILD PATCHv3] wireguard: disable in FIPS mode

[Hangbin Liu (via Email Bridge)]

From: Hangbin Liu <haliu(a)redhat.com&gt;

wireguard: disable in FIPS mode

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1940794
Upstream: RHEL Only

The cryptos(BLAKE2S, Curve25519, CHACHA20POLY1305) in WireGuard are not
FIPS approved. Disable loading the cryptos is a better solution, but the
cryptos called by WireGuard are in lib/crypto/ instead of crypto/, which
is a little complex to disable. While disabling the WireGuard module is
more clear and easier.

So let's disable the WireGuard in FIPS mode first. When the issue that
loading the lib/crypto/ code in FIPS mode is fixed. We can revert this
internal patch.

Signed-off-by: Hangbin Liu <haliu(a)redhat.com&gt;

diff a/drivers/net/wireguard/main.c b/drivers/net/wireguard/main.c
--- a/drivers/net/wireguard/main.c
+++ b/drivers/net/wireguard/main.c
@@ -12,6 +12,7 @@
 
 #include <uapi/linux/wireguard.h>
 
+#include <linux/fips.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/genetlink.h>
@@ -21,6 +22,11 @@ static int __init mod_init(void)
 {
 	int ret;
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (fips_enabled)
+		return -EOPNOTSUPP;
+#endif
+
 #ifdef DEBUG
 	if (!wg_allowedips_selftest() || !wg_packet_counter_selftest() ||
 	    !wg_ratelimiter_selftest())

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994

[Hangbin Liu (via Email Bridge)]

From: Hangbin Liu on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_55448...

Hi @jbencrh @sdubroca @omos @marcelo.leitner, The [upstream
patch](https://www.spinics.net/lists/netdev/msg733537.html) was
rejected. I have updated the commit description. Would you please review
it?


Thanks
Hangbin

[Hangbin Liu (via Email Bridge)]

From: Hangbin Liu on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_55448...

BTW, not sure if I should cc Simo Sorce and Herbert Xu for this MR. But
I don't know their gitlab account...

[Jiri Benc (via Email Bridge)]

From: Jiri Benc on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_55451...

Thanks for the link to the upstream discussion. I read the whole thread
and it doesn't seem to me the idea was rejected. Just a different
implementation was requested. We should pursue the different
implementation (disabling in the crypto library instead of in the crypto
user) first. Am I missing something?

[Hangbin Liu (via Email Bridge)]

From: Hangbin Liu on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_55772...

@jbencrh Yes, Sushil, Sabrina and I have a sync meeting with Simo and
crypto team. We should disable the crypto part at last, but it's a
little complex and will not land soon. So we decide to disable the
wiregurad first and revert this patch when the crypto part get fixed.

@sdubroca please correct me if I made a mistake.

Thanks
Hangbin

[Jiri Benc (via Email Bridge)]

From: Jiri Benc on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_56120...

Thanks for putting the explanation in the patch description. I'm okay
with this approach.

[Simo Sorce (via Email Bridge)]

From: Simo Sorce on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_56153...

@liuhangbin LGTM!

Simo.

[Don Zickus (via Email Bridge)]

From: Don Zickus on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_56162...

@liuhangbin @jbencrh - just to be clear, this is considered a short term
workaround, with the goal of a proper fix before RHEL-9 forks around
5.14?

[Hangbin Liu (via Email Bridge)]

From: Hangbin Liu on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_56211...

@dzickusrh Yes, this is a short-term workaround. However, I don't know
the process of lib/crypto update for crypto team. So I'm not sure if
this could be done around 5.14. @simo5 Is there a schedule?

[Simo Sorce (via Email Bridge)]

From: Simo Sorce on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_56292...

@liuhangbin @dzickusrh
We do not have a better solution.
The stuff proposed by Jason upstream was speculative and is highly
invasive and we are *not* planning to do that work. Neither anyone else
upstream accepted that as a workable solution.
So I would consider this patch the current proposed long term fix for
RHEL-9

[Hangbin Liu (via Email Bridge)]

From: Hangbin Liu on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/994#note_56324...

Thanks Simo for the explanation.