nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

selftests: net: fcnal-test: check if FIPS mode is enabled

Browse source 
There are some MD5 tests which fail when the kernel is in FIPS mode,
since MD5 is not FIPS compliant. Add a check and only run those tests
if FIPS mode is not enabled.

Fixes: f0bee1ebb5 ("fcnal-test: Add TCP MD5 tests")
Fixes: 5cad8bce26 ("fcnal-test: Add TCP MD5 tests for VRF")
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Magali Lemes <magali.lemes@canonical.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Magali Lemes 2023-06-13 09:32:22 -03:00 committed by Jakub Kicinski
parent cb43c60e64
commit d7a2fc1437
1 changed files with 19 additions and 8 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

27
tools/testing/selftests/net/fcnal-test.sh
View file

@ -92,6 +92,13 @@ NSC_CMD="ip netns exec ${NSC}"
which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)
# Check if FIPS mode is enabled
if [ -f /proc/sys/crypto/fips_enabled ]; then
fips_enabled=`cat /proc/sys/crypto/fips_enabled`
else
fips_enabled=0
fi
################################################################################ ################################################################################
# utilities # utilities
@ -1216,7 +1223,7 @@ ipv4_tcp_novrf()
run_cmd nettest -d ${NSA_DEV} -r ${a} run_cmd nettest -d ${NSA_DEV} -r ${a}
log_test_addr ${a} $? 1 "No server, device client, local conn" log_test_addr ${a} $? 1 "No server, device client, local conn"
ipv4_tcp_md5_novrf [ "$fips_enabled" = "1" ] || ipv4_tcp_md5_novrf
} }
ipv4_tcp_vrf() ipv4_tcp_vrf()
@ -1270,9 +1277,11 @@ ipv4_tcp_vrf()
log_test_addr ${a} $? 1 "Global server, local connection" log_test_addr ${a} $? 1 "Global server, local connection"
# run MD5 tests # run MD5 tests
setup_vrf_dup if [ "$fips_enabled" = "0" ]; then
ipv4_tcp_md5 setup_vrf_dup
cleanup_vrf_dup ipv4_tcp_md5
cleanup_vrf_dup
fi
# #
# enable VRF global server # enable VRF global server
@ -2772,7 +2781,7 @@ ipv6_tcp_novrf()
log_test_addr ${a} $? 1 "No server, device client, local conn" log_test_addr ${a} $? 1 "No server, device client, local conn"
done done
ipv6_tcp_md5_novrf [ "$fips_enabled" = "1" ] || ipv6_tcp_md5_novrf
} }
ipv6_tcp_vrf() ipv6_tcp_vrf()
@ -2842,9 +2851,11 @@ ipv6_tcp_vrf()
log_test_addr ${a} $? 1 "Global server, local connection" log_test_addr ${a} $? 1 "Global server, local connection"
# run MD5 tests # run MD5 tests
setup_vrf_dup if [ "$fips_enabled" = "0" ]; then
ipv6_tcp_md5 setup_vrf_dup
cleanup_vrf_dup ipv6_tcp_md5
cleanup_vrf_dup
fi
# #
# enable VRF global server # enable VRF global server