| Message ID | 20230613123222.631897-1-magali.lemes@canonical.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Check if FIPS mode is enabled when running selftests | expand |
Hello: This series was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 13 Jun 2023 09:32:18 -0300 you wrote: > Some test cases from net/tls, net/fcnal-test and net/vrf-xfrm-tests > that rely on cryptographic functions to work and use non-compliant FIPS > algorithms fail in FIPS mode. > > In order to allow these tests to pass in a wider set of kernels, > - for net/tls, skip the test variants that use the ChaCha20-Poly1305 > and SM4 algorithms, when FIPS mode is enabled; > - for net/fcnal-test, skip the MD5 tests, when FIPS mode is enabled; > - for net/vrf-xfrm-tests, replace the algorithms that are not > FIPS-compliant with compliant ones. > > [...] Here is the summary with links: - [v4,1/4] selftests/harness: allow tests to be skipped during setup https://git.kernel.org/netdev/net/c/372b304c1e51 - [v4,2/4] selftests: net: tls: check if FIPS mode is enabled https://git.kernel.org/netdev/net/c/d113c395c67b - [v4,3/4] selftests: net: vrf-xfrm-tests: change authentication and encryption algos https://git.kernel.org/netdev/net/c/cb43c60e64ca - [v4,4/4] selftests: net: fcnal-test: check if FIPS mode is enabled https://git.kernel.org/netdev/net/c/d7a2fc1437f7 You are awesome, thank you!
Some test cases from net/tls, net/fcnal-test and net/vrf-xfrm-tests that rely on cryptographic functions to work and use non-compliant FIPS algorithms fail in FIPS mode. In order to allow these tests to pass in a wider set of kernels, - for net/tls, skip the test variants that use the ChaCha20-Poly1305 and SM4 algorithms, when FIPS mode is enabled; - for net/fcnal-test, skip the MD5 tests, when FIPS mode is enabled; - for net/vrf-xfrm-tests, replace the algorithms that are not FIPS-compliant with compliant ones. Changes in v4: - Remove extra newline. - Add R-b tag. Changes in v3: - Add new commit to allow skipping test directly from test setup. - No need to initialize static variable to zero. - Skip tests during test setup only. - Use the constructor attribute to set fips_enabled before entering main(). Changes in v2: - Add R-b tags. - Put fips_non_compliant into the variants. - Turn fips_enabled into a static global variable. - Read /proc/sys/crypto/fips_enabled only once at main(). v1: https://lore.kernel.org/netdev/20230607174302.19542-1-magali.lemes@canonical.com/ v2: https://lore.kernel.org/netdev/20230609164324.497813-1-magali.lemes@canonical.com/ v3: https://lore.kernel.org/netdev/20230612125107.73795-1-magali.lemes@canonical.com/ Magali Lemes (4): selftests/harness: allow tests to be skipped during setup selftests: net: tls: check if FIPS mode is enabled selftests: net: vrf-xfrm-tests: change authentication and encryption algos selftests: net: fcnal-test: check if FIPS mode is enabled tools/testing/selftests/kselftest_harness.h | 6 ++-- tools/testing/selftests/net/fcnal-test.sh | 27 +++++++++++----- tools/testing/selftests/net/tls.c | 24 +++++++++++++- tools/testing/selftests/net/vrf-xfrm-tests.sh | 32 +++++++++---------- 4 files changed, 61 insertions(+), 28 deletions(-)