Add the ability to turn FIPS-compliant mode on or off at boot
In order to be FIPS compliant, several check may need to be preformed that may
be construed as unusefull in a non-compliant mode. This patch allows us to set
a kernel flag incating that we are running in a fips-compliant mode from boot
up. It also exports that mode information to user space via a sysctl
(/proc/sys/crypto/fips_enabled).
Tested successfully by me.
Neil
Signed-off-by: Neil Horman <[email protected]>
api.c | 14 ++++++++++++++
internal.h | 2 ++
proc.c | 32 ++++++++++++++++++++++++++++++++
3 files changed, 48 insertions(+)
diff --git a/crypto/api.c b/crypto/api.c
index d06e332..897070c 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -450,5 +450,19 @@ int crypto_has_alg(const char *name, u32 type, u32 mask)
}
EXPORT_SYMBOL_GPL(crypto_has_alg);
+
+int fips_enabled;
+
+/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */
+static int fips_enable(char *str)
+{
+ fips_enabled = !!simple_strtol(str, NULL, 0);
+ printk(KERN_INFO "fips mode: %s\n",
+ fips_enabled ? "enabled" : "disabled");
+ return 1;
+}
+
+__setup("fips=", fips_enable);
+
MODULE_DESCRIPTION("Cryptographic core API");
MODULE_LICENSE("GPL");
diff --git a/crypto/internal.h b/crypto/internal.h
index 683fcb2..ec44f47 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -26,6 +26,8 @@
#include <linux/rwsem.h>
#include <linux/slab.h>
+extern int fips_enabled;
+
/* Crypto notification events. */
enum {
CRYPTO_MSG_ALG_REQUEST,
diff --git a/crypto/proc.c b/crypto/proc.c
index 02ff567..07864ec 100644
--- a/crypto/proc.c
+++ b/crypto/proc.c
@@ -19,8 +19,37 @@
#include <linux/rwsem.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
+#include <linux/sysctl.h>
#include "internal.h"
+static struct ctl_table crypto_sysctl_table[] = {
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "fips_enabled",
+ .data = &fips_enabled,
+ .maxlen = sizeof(int),
+ .mode = 0444,
+ .proc_handler = &proc_dointvec
+ },
+ {
+ .ctl_name = 0,
+ },
+};
+
+static struct ctl_table crypto_dir_table[] = {
+ {
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "crypto",
+ .mode = 0555,
+ .child = crypto_sysctl_table
+ },
+ {
+ .ctl_name = 0,
+ },
+};
+
+static struct ctl_table_header *crypto_sysctls;
+
static void *c_start(struct seq_file *m, loff_t *pos)
{
down_read(&crypto_alg_sem);
@@ -100,9 +129,12 @@ static const struct file_operations proc_crypto_ops = {
void __init crypto_init_proc(void)
{
proc_create("crypto", 0, NULL, &proc_crypto_ops);
+ crypto_sysctls = register_sysctl_table(crypto_dir_table);
}
void __exit crypto_exit_proc(void)
{
remove_proc_entry("crypto", NULL);
+ if (crypto_sysctls)
+ unregister_sysctl_table(crypto_sysctls);
}
--
/****************************************************
* Neil Horman <[email protected]>
* Software Engineer, Red Hat
****************************************************/
On Wed, Jul 30, 2008 at 04:34:07PM -0400, Neil Horman wrote:
>
> +int fips_enabled;
This didn't build for me:
Building modules, stage 2.
MODPOST 58 modules
WARNING: "fips_enabled" [crypto/crypto_algapi.ko] undefined!
So I've added an EXPORT_SYMBOL_GPL on it and applied to cryptodev-2.6.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
On Tue, Aug 05, 2008 at 02:14:22PM +0800, Herbert Xu wrote:
>
> So I've added an EXPORT_SYMBOL_GPL on it and applied to cryptodev-2.6.
I've moved fips_enabled into its own file because the crypto API
can be built as a module. I've also added a Kconfig option so
this has no impact on non-FIPS users.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
diff --git a/crypto/Kconfig b/crypto/Kconfig
index a985065..e26512e 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -21,6 +21,14 @@ if CRYPTO
comment "Crypto core or helper"
+config CRYPTO_FIPS
+ bool
+ help
+ This options enables the fips boot option which is
+ required if you want to system to operate in a FIPS 200
+ certification. You should say no unless you know what
+ this is.
+
config CRYPTO_ALGAPI
tristate
help
diff --git a/crypto/Makefile b/crypto/Makefile
index ed2be05..e3ce913 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -5,6 +5,8 @@
obj-$(CONFIG_CRYPTO) += crypto.o
crypto-objs := api.o cipher.o digest.o compress.o
+obj-$(CONFIG_FIPS) += fips.o
+
crypto_algapi-$(CONFIG_PROC_FS) += proc.o
crypto_algapi-objs := algapi.o scatterwalk.o $(crypto_algapi-y)
obj-$(CONFIG_CRYPTO_ALGAPI) += crypto_algapi.o
diff --git a/crypto/api.c b/crypto/api.c
index cd232d4..0444d24 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -493,19 +493,5 @@ int crypto_has_alg(const char *name, u32 type, u32 mask)
}
EXPORT_SYMBOL_GPL(crypto_has_alg);
-int fips_enabled;
-EXPORT_SYMBOL_GPL(fips_enabled);
-
-/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */
-static int fips_enable(char *str)
-{
- fips_enabled = !!simple_strtol(str, NULL, 0);
- printk(KERN_INFO "fips mode: %s\n",
- fips_enabled ? "enabled" : "disabled");
- return 1;
-}
-
-__setup("fips=", fips_enable);
-
MODULE_DESCRIPTION("Cryptographic core API");
MODULE_LICENSE("GPL");
diff --git a/crypto/fips.c b/crypto/fips.c
new file mode 100644
index 0000000..070a18e
--- /dev/null
+++ b/crypto/fips.c
@@ -0,0 +1,27 @@
+/*
+ * FIPS 200 support.
+ *
+ * Copyright (c) 2008 Neil Horman <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#include "internal.h"
+
+int fips_enabled;
+EXPORT_SYMBOL_GPL(fips_enabled);
+
+/* Process kernel command-line parameter at boot time. fips=0 or fips=1 */
+static int fips_enable(char *str)
+{
+ fips_enabled = !!simple_strtol(str, NULL, 0);
+ printk(KERN_INFO "fips mode: %s\n",
+ fips_enabled ? "enabled" : "disabled");
+ return 1;
+}
+
+__setup("fips=", fips_enable);
diff --git a/crypto/internal.h b/crypto/internal.h
index b7fcd30..8ef72d7 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -26,7 +26,11 @@
#include <linux/rwsem.h>
#include <linux/slab.h>
+#ifdef CONFIG_CRYPTO_FIPS
extern int fips_enabled;
+#else
+#define fips_enabled 0
+#endif
/* Crypto notification events. */
enum {
diff --git a/crypto/proc.c b/crypto/proc.c
index 29601dc..37a13d0 100644
--- a/crypto/proc.c
+++ b/crypto/proc.c
@@ -22,6 +22,7 @@
#include <linux/sysctl.h>
#include "internal.h"
+#ifdef CONFIG_CRYPTO_FIPS
static struct ctl_table crypto_sysctl_table[] = {
{
.ctl_name = CTL_UNNUMBERED,
@@ -50,6 +51,21 @@ static struct ctl_table crypto_dir_table[] = {
static struct ctl_table_header *crypto_sysctls;
+static void crypto_proc_fips_init(void)
+{
+ crypto_sysctls = register_sysctl_table(crypto_dir_table);
+}
+
+static void crypto_proc_fips_exit(void)
+{
+ if (crypto_sysctls)
+ unregister_sysctl_table(crypto_sysctls);
+}
+#else
+#define crypto_proc_fips_init()
+#define crypto_proc_fips_exit()
+#endif
+
static void *c_start(struct seq_file *m, loff_t *pos)
{
down_read(&crypto_alg_sem);
@@ -135,12 +151,11 @@ static const struct file_operations proc_crypto_ops = {
void __init crypto_init_proc(void)
{
proc_create("crypto", 0, NULL, &proc_crypto_ops);
- crypto_sysctls = register_sysctl_table(crypto_dir_table);
+ crypto_proc_fips_init();
}
void __exit crypto_exit_proc(void)
{
+ crypto_proc_fips_exit();
remove_proc_entry("crypto", NULL);
- if (crypto_sysctls)
- unregister_sysctl_table(crypto_sysctls);
}
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 56f23a0..e0744c1 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -699,6 +699,7 @@ config CRYPTO_ANSI_CPRNG
tristate "Pseudo Random Number Generation for Cryptographic modules"
select CRYPTO_AES
select CRYPTO_RNG
+ select CRYPTO_FIPS
help
This option enables the generic pseudo random number generator
for cryptographic modules. Uses the Algorithm specified in
On Tue, Aug 19, 2008 at 05:55:35PM +1000, Herbert Xu wrote:
>
> diff --git a/crypto/Makefile b/crypto/Makefile
> index ed2be05..e3ce913 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile
> @@ -5,6 +5,8 @@
> obj-$(CONFIG_CRYPTO) += crypto.o
> crypto-objs := api.o cipher.o digest.o compress.o
>
> +obj-$(CONFIG_FIPS) += fips.o
> +
> crypto_algapi-$(CONFIG_PROC_FS) += proc.o
> crypto_algapi-objs := algapi.o scatterwalk.o $(crypto_algapi-y)
> obj-$(CONFIG_CRYPTO_ALGAPI) += crypto_algapi.o
Doh, made a typo here. This patch fixes it up.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
diff --git a/crypto/Makefile b/crypto/Makefile
index e3ce913..5862b80 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -5,7 +5,7 @@
obj-$(CONFIG_CRYPTO) += crypto.o
crypto-objs := api.o cipher.o digest.o compress.o
-obj-$(CONFIG_FIPS) += fips.o
+obj-$(CONFIG_CRYPTO_FIPS) += fips.o
crypto_algapi-$(CONFIG_PROC_FS) += proc.o
crypto_algapi-objs := algapi.o scatterwalk.o $(crypto_algapi-y)
On Tue, Aug 19, 2008 at 06:08:30PM +1000, Herbert Xu wrote:
> On Tue, Aug 19, 2008 at 05:55:35PM +1000, Herbert Xu wrote:
> >
> > diff --git a/crypto/Makefile b/crypto/Makefile
> > index ed2be05..e3ce913 100644
> > --- a/crypto/Makefile
> > +++ b/crypto/Makefile
> > @@ -5,6 +5,8 @@
> > obj-$(CONFIG_CRYPTO) += crypto.o
> > crypto-objs := api.o cipher.o digest.o compress.o
> >
> > +obj-$(CONFIG_FIPS) += fips.o
> > +
> > crypto_algapi-$(CONFIG_PROC_FS) += proc.o
> > crypto_algapi-objs := algapi.o scatterwalk.o $(crypto_algapi-y)
> > obj-$(CONFIG_CRYPTO_ALGAPI) += crypto_algapi.o
>
> Doh, made a typo here. This patch fixes it up.
>
Copy that, thanks herbert!
Neil
> Cheers,
> --
> Visit Openswan at http://www.openswan.org/
> Email: Herbert Xu ~{PmV>HI~} <[email protected]>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
> --
> diff --git a/crypto/Makefile b/crypto/Makefile
> index e3ce913..5862b80 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile
> @@ -5,7 +5,7 @@
> obj-$(CONFIG_CRYPTO) += crypto.o
> crypto-objs := api.o cipher.o digest.o compress.o
>
> -obj-$(CONFIG_FIPS) += fips.o
> +obj-$(CONFIG_CRYPTO_FIPS) += fips.o
>
> crypto_algapi-$(CONFIG_PROC_FS) += proc.o
> crypto_algapi-objs := algapi.o scatterwalk.o $(crypto_algapi-y)
--
/****************************************************
* Neil Horman <[email protected]>
* Software Engineer, Red Hat
****************************************************/