On Tue, 2022-12-20 at 10:40 +0530, Ashwin Dayanand Kamat wrote: > MD5 is not FIPS compliant. But still md5 was used as the default algorithm > for sctp if fips was enabled. > Due to this, listen() system call in ltp tests was failing for sctp > in fips environment, with below error message. > > [ 6397.892677] sctp: failed to load transform for md5: -2 > > Fix is to not assign md5 as default algorithm for sctp > if fips_enabled is true. Instead make sha1 as default algorithm. > > Signed-off-by: Ashwin Dayanand Kamat <kashwindayan@xxxxxxxxxx> I don't know the fips standard in details, but it feel strange that you get fips compliance _disabling_ the encryption. Can you please point which part of the standard states it? Since this is fix, you should also provide a suitable fixes tag. When you will repost additionally include the target tree name (net) into the subject, thanks! > --- > net/sctp/protocol.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > > diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c > index 909a89a..b6e9810 100644 > --- a/net/sctp/protocol.c > +++ b/net/sctp/protocol.c > @@ -34,6 +34,7 @@ > #include <linux/memblock.h> > #include <linux/highmem.h> > #include <linux/slab.h> > +#include <linux/fips.h> > #include <net/net_namespace.h> > #include <net/protocol.h> > #include <net/ip.h> > @@ -1321,14 +1322,13 @@ static int __net_init sctp_defaults_init(struct net *net) > /* Whether Cookie Preservative is enabled(1) or not(0) */ > net->sctp.cookie_preserve_enable = 1; > > - /* Default sctp sockets to use md5 as their hmac alg */ > -#if defined (CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5) > - net->sctp.sctp_hmac_alg = "md5"; > -#elif defined (CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1) > - net->sctp.sctp_hmac_alg = "sha1"; > -#else > - net->sctp.sctp_hmac_alg = NULL; > -#endif > + /* Default sctp sockets to use md5 as default only if fips is not enabled */ > + if (!fips_enabled && IS_ENABLED(CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5)) > + net->sctp.sctp_hmac_alg = "md5"; > + else if (IS_ENABLED(CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1)) > + net->sctp.sctp_hmac_alg = "sha1"; > + else > + net->sctp.sctp_hmac_alg = NULL; It looks like the listener can still fail if fips mode is enabled after that the netns is initialized. I think it would be better to take action in sctp_listen_start() and buming a ratelimited notice the selected hmac is changed due to fips. Thanks, Paolo > > /* Max.Burst - 4 */ > net->sctp.max_burst = SCTP_DEFAULT_MAX_BURST;
