[PATCH net-next] [RESEND] wireguard: disable in FIPS mode
From: Hangbin Liu <hidden>
Date: 2021-04-07 11:39:52
Also in:
netdev
Subsystem:
networking drivers, the rest, wireguard secure network tunnel · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Jason A. Donenfeld
As the cryptos(BLAKE2S, Curve25519, CHACHA20POLY1305) in WireGuard are not FIPS certified, the WireGuard module should be disabled in FIPS mode. Signed-off-by: Hangbin Liu <redacted> --- drivers/net/wireguard/main.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireguard/main.c b/drivers/net/wireguard/main.c
index 7a7d5f1a80fc..8a9aaea7623c 100644
--- a/drivers/net/wireguard/main.c
+++ b/drivers/net/wireguard/main.c@@ -12,6 +12,7 @@ #include <uapi/linux/wireguard.h> +#include <linux/fips.h> #include <linux/init.h> #include <linux/module.h> #include <linux/genetlink.h>
@@ -21,6 +22,9 @@ static int __init mod_init(void) { int ret; + if (fips_enabled) + return -EOPNOTSUPP; + #ifdef DEBUG if (!wg_allowedips_selftest() || !wg_packet_counter_selftest() || !wg_ratelimiter_selftest())
--
2.26.3