2db9143a1b
To meet FIPS 140 requirements, add support for building a kernel module
"fips140.ko" that contains various cryptographic algorithms built from
existing kernel source files. At load time, the module checks its own
integrity and self-tests its algorithms, then registers the algorithms
with the crypto API to supersede the original algorithms provided by the
kernel itself.
[ebiggers: this commit originated from "ANDROID: crypto: fips140 -
perform load time integrity check", but I've folded many later commits
into it to make forward porting easier. See below]
Original commits from android12-5.10:
* 6be141eb36fe ("ANDROID: crypto: fips140 - perform load time integrity check")
* 868be244bbed ("ANDROID: inject correct HMAC digest into fips140.ko at build time")
* 091338cb398e ("ANDROID: fips140: add missing static keyword to fips140_init()")
* c799c6644b52 ("ANDROID: fips140: adjust some log messages")
* 92de53472e68 ("ANDROID: fips140: log already-live algorithms")
* 0af06624eadc ("ANDROID: fips140: check for errors from initcalls")
* 634445a640a4 ("ANDROID: fips140: fix deadlock in unregister_existing_fips140_algos()")
* e886dd4c339e ("ANDROID: fips140: unregister existing DRBG algorithms")
* b7397e89db29 ("ANDROID: fips140: add power-up cryptographic self-tests")
* 50661975be74 ("ANDROID: fips140: add/update module help text")
* b397a0387cb2 ("ANDROID: fips140: test all implementations")
* 17ccefe14021 ("ANDROID: fips140: use full 16-byte IV")
* 1be58af0776a ("ANDROID: fips140: remove non-prediction-resistant DRBG test")
* 2b5843ae2d90 ("ANDROID: fips140: add AES-CBC-CTS")
* 2ee56aad318c ("ANDROID: fips140: add AES-CMAC")
* 960ebb2b565b ("ANDROID: fips140: add jitterentropy to fips140 module")
* e5b14396f9d2 ("ANDROID: fips140: take into account AES-GCM not being approvable")
* 52b70d491bd4 ("ANDROID: fips140: use FIPS140_CFLAGS when compiling fips140-selftests.c")
* 6b995f5a5403 ("ANDROID: fips140: preserve RELA sections without relying on the module loader")
* e45108ecff64 ("ANDROID: fips140: block crypto operations until tests complete")
* ecf9341134d1 ("ANDROID: fips140: remove in-place updating of live algorithms")
* 482b0323cf29 ("ANDROID: fips140: zeroize temporary values from integrity check")
* 64d769e53f20 ("ANDROID: fips140: add service indicators")
* 8d7f609cdaa4 ("ANDROID: fips140: add name and version, and a function to retrieve them")
* 6b7c37f6c449 ("ANDROID: fips140: use UTS_RELEASE as FIPS version")
* 903e97a0ca6d ("ANDROID: fips140: refactor evaluation testing support")
* 97fb2104fe22 ("ANDROID: fips140: add support for injecting integrity error")
* 109f31ac23f5 ("ANDROID: fips140: add userspace interface for evaluation testing")
Bug: 153614920
Bug: 188620248
Test: tested that the module builds and can be loaded on raven.
Change-Id: I3fde49dbc3d16b149b072a27ba5b4c6219015c94
Signed-off-by: Ard Biesheuvel <ardb@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
51 lines
1.3 KiB
C
51 lines
1.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright 2021 Google LLC
|
|
*/
|
|
|
|
#ifndef _CRYPTO_FIPS140_MODULE_H
|
|
#define _CRYPTO_FIPS140_MODULE_H
|
|
|
|
#include <linux/completion.h>
|
|
#include <linux/module.h>
|
|
#include <generated/utsrelease.h>
|
|
|
|
#undef pr_fmt
|
|
#define pr_fmt(fmt) "fips140: " fmt
|
|
|
|
/*
|
|
* This is the name and version number of the module that are shown on the FIPS
|
|
* certificate.
|
|
*/
|
|
#define FIPS140_MODULE_NAME "Android Kernel Cryptographic Module"
|
|
#define FIPS140_MODULE_VERSION UTS_RELEASE
|
|
|
|
/* fips140-eval-testing.c */
|
|
#ifdef CONFIG_CRYPTO_FIPS140_MOD_EVAL_TESTING
|
|
void fips140_inject_selftest_failure(const char *impl, u8 *result);
|
|
void fips140_inject_integrity_failure(u8 *textcopy);
|
|
bool fips140_eval_testing_init(void);
|
|
#else
|
|
static inline void fips140_inject_selftest_failure(const char *impl, u8 *result)
|
|
{
|
|
}
|
|
static inline void fips140_inject_integrity_failure(u8 *textcopy)
|
|
{
|
|
}
|
|
static inline bool fips140_eval_testing_init(void)
|
|
{
|
|
return true;
|
|
}
|
|
#endif /* !CONFIG_CRYPTO_FIPS140_MOD_EVAL_TESTING */
|
|
|
|
/* fips140-module.c */
|
|
extern struct completion fips140_tests_done;
|
|
extern struct task_struct *fips140_init_thread;
|
|
bool fips140_is_approved_service(const char *name);
|
|
const char *fips140_module_version(void);
|
|
|
|
/* fips140-selftests.c */
|
|
bool __init __must_check fips140_run_selftests(void);
|
|
|
|
#endif /* _CRYPTO_FIPS140_MODULE_H */
|