[PATCH] libceph: Re-establish the FIPS keylength check in the Ceph code

[Thomas Huth <thuth@redhat.com>]

When the Ceph code had been updated to use the libcrypto hmac_sha256
functions instead of the "hmac(sha256)" crypto shash driver, we lost
the FIPS key length check from  hmac_setkey() in crypto/hmac.c.
Since libcrypto won't support this FIPS check (it should be done in
the calling sites instead), add the check now to the Ceph code
instead to make this code more FIPS friendly again.

Fixes: 27c0a7b05d13a ("libceph: Use HMAC-SHA256 library instead of crypto_shash")
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 net/ceph/messenger_v2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
index 05f6eea299fc0..378493d5d7155 100644
--- a/net/ceph/messenger_v2.c
+++ b/net/ceph/messenger_v2.c
@@ -12,6 +12,7 @@
 #include <crypto/utils.h>
 #include <linux/bvec.h>
 #include <linux/crc32c.h>
+#include <linux/fips.h>
 #include <linux/net.h>
 #include <linux/scatterlist.h>
 #include <linux/socket.h>
@@ -721,6 +722,9 @@ static int setup_crypto(struct ceph_connection *con,
 		return 0;  /* auth_none */
 	}
 
+	if (fips_enabled && session_key_len < 112 / 8)
+		return -EKEYREJECTED;
+
 	hmac_sha256_preparekey(&con->v2.hmac_key, session_key, session_key_len);
 	con->v2.hmac_key_set = true;
 
-- 
2.55.0