| Message ID | 20240311121929.212472-3-berrange@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | crypto: handle gcrypt ciphers being disabled | expand |
On 11/03/2024 13.19, Daniel P. Berrangé wrote: > Just because a cipher is defined in the gcrypt header file, does not > imply that it can be used. Distros can filter the list of ciphers when > building gcrypt. For example, RHEL-9 disables the SM4 cipher. It is > also possible that running in FIPS mode might dynamically change what > ciphers are available at runtime. > > qcrypto_cipher_supports must therefore query gcrypt directly to check > for cipher availability. > > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> > --- > crypto/cipher-gcrypt.c.inc | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/crypto/cipher-gcrypt.c.inc b/crypto/cipher-gcrypt.c.inc > index 6b82280f90..4a8314746d 100644 > --- a/crypto/cipher-gcrypt.c.inc > +++ b/crypto/cipher-gcrypt.c.inc > @@ -93,6 +93,11 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg, > return false; > } > > + if (gcry_cipher_algo_info(qcrypto_cipher_alg_to_gcry_alg(alg), > + GCRYCTL_TEST_ALGO, NULL, NULL) != 0) { > + return false; > + } > + > switch (mode) { > case QCRYPTO_CIPHER_MODE_ECB: > case QCRYPTO_CIPHER_MODE_CBC: Reviewed-by: Thomas Huth <thuth@redhat.com>
diff --git a/crypto/cipher-gcrypt.c.inc b/crypto/cipher-gcrypt.c.inc index 6b82280f90..4a8314746d 100644 --- a/crypto/cipher-gcrypt.c.inc +++ b/crypto/cipher-gcrypt.c.inc @@ -93,6 +93,11 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg, return false; } + if (gcry_cipher_algo_info(qcrypto_cipher_alg_to_gcry_alg(alg), + GCRYCTL_TEST_ALGO, NULL, NULL) != 0) { + return false; + } + switch (mode) { case QCRYPTO_CIPHER_MODE_ECB: case QCRYPTO_CIPHER_MODE_CBC:
Just because a cipher is defined in the gcrypt header file, does not imply that it can be used. Distros can filter the list of ciphers when building gcrypt. For example, RHEL-9 disables the SM4 cipher. It is also possible that running in FIPS mode might dynamically change what ciphers are available at runtime. qcrypto_cipher_supports must therefore query gcrypt directly to check for cipher availability. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- crypto/cipher-gcrypt.c.inc | 5 +++++ 1 file changed, 5 insertions(+)