From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DAD0EC54E60 for ; Wed, 13 Mar 2024 20:22:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=ueY0Fg2Q+HWX5QZDovL45O5d1mR9w0KNBdHb0ca/5jA=; b=Z3w2+9lKBuLy2G J/ftcO2GOETa2jqmyViFyZbTU3EwvqhKbxeCtfrrY9TJ2cDLb8OgxMHvQr+uCnxIqv83vTJ/5NgB7 pRvXwyYOfD2rGf0kY0aLLUII/lYRc4wETGpkq2+8EHAai7fUdKtULjrSuygqncUTc5FZSiohXH7qe ka5iM7mSzOwWb/JSHvTfamKghxG46YUqa59mR+TSTWhNIy54qkfUGrScbixh46sSJhcQN2IDlHD2u DgfxAySNamJdcAbmqeHbnmTz4lryCm2PPBPsVw6GVRfc2EjzOaVVTQHrxIzfNMrxoK4RoGDtGoAyV ZUt9kpS7j1pf5xEeyqAg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rkV7R-0000000BoKw-1oXh; Wed, 13 Mar 2024 20:22:33 +0000 Received: from sin.source.kernel.org ([145.40.73.55]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rkV7M-0000000BoIu-0t2g for linux-arm-kernel@lists.infradead.org; Wed, 13 Mar 2024 20:22:32 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 986D0CE1C1C; Wed, 13 Mar 2024 20:22:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BA20C433F1; Wed, 13 Mar 2024 20:22:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1710361345; bh=rgukJbYU+P6pCiW7WPZ0odGPFMvz8t4VPdQBD930lsY=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=mFlAHNW2U31SD7nKmJI4b7+wEklDjsk/bQ8BQxWUr206VF6u/NDhARmY7EwziZWHL uJgVdR0u8oJWsY9qOkLBXcvaQbnOCHpSwkW+0tZNeu7an3CwLwVzuJ8M3ZXzQGhx6r pN78QKRGcle4kw748mX/YLsb8xJuqGGiXJ5o+YimikW5hqKEQw2jh7UKz5fxbIBaeV FjN4xBzuITH1CzB8PEfUlA9uicYznEVUw9SW7+8ZZuIantuoR49VinlAU4aSSf8wHo y83rkovNZggjXEvqkM53hVvea0wF74bMh7LULVEAK1qIy+KmP1EihrCLfs61vEqTfZ GCDKedIzuPVWg== Date: Wed, 13 Mar 2024 13:22:23 -0700 From: Eric Biggers To: James Prestwood Cc: Johannes Berg , Karel Balej , dimitri.ledkov@canonical.com, alexandre.torgue@foss.st.com, davem@davemloft.net, dhowells@redhat.com, herbert@gondor.apana.org.au, keyrings@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-modules@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, mcgrof@kernel.org, mcoquelin.stm32@gmail.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, iwd@lists.linux.dev Subject: Re: [REGRESSION] Re: [PATCH] crypto: pkcs7: remove sha1 support Message-ID: <20240313202223.GB1111@sol.localdomain> References: <005f998ec59e27633b1b99fdf929e40ccfd401c1.camel@sipsolutions.net> <20240313194423.GA1111@sol.localdomain> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240313_132229_350187_64BDAE30 X-CRM114-Status: GOOD ( 27.65 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Mar 13, 2024 at 01:12:54PM -0700, James Prestwood wrote: > Hi, > > On 3/13/24 12:44 PM, Eric Biggers wrote: > > On Wed, Mar 13, 2024 at 10:26:06AM -0700, James Prestwood wrote: > > > Hi, > > > > > > On 3/13/24 1:56 AM, Johannes Berg wrote: > > > > Not sure why you're CC'ing the world, but I guess adding a few more > > > > doesn't hurt ... > > > > > > > > On Wed, 2024-03-13 at 09:50 +0100, Karel Balej wrote: > > > > > and I use iwd > > > > This is your problem, the wireless stack in the kernel doesn't use any > > > > kernel crypto code for 802.1X. > > > Yes, the wireless stack has zero bearing on the issue. I think that's what > > > you meant by "problem". > > > > > > IWD has used the kernel crypto API forever which was abruptly broken, that > > > is the problem. > > > > > > The original commit says it was to remove support for sha1 signed kernel > > > modules, but it did more than that and broke the keyctl API. > > > > > Which specific API is iwd using that is relevant here? > > I cloned https://kernel.googlesource.com/pub/scm/network/wireless/iwd > > and grepped for keyctl and AF_ALG, but there are no matches. > > IWD uses ELL for its crypto, which uses the AF_ALG API: > > https://git.kernel.org/pub/scm/libs/ell/ell.git/ Thanks for pointing out that the relevant code is really in that separate repository. Note, it seems that keyctl() is the problem here, not AF_ALG. The blamed commit didn't change anything for AF_ALG. > I believe the failure is when calling: > > KEYCTL_PKEY_QUERY enc="x962" hash="sha1" > > From logs Michael posted on the IWD list, the ELL API that fails is: > > l_key_get_info (ell.git/ell/key.c:416) Okay, I guess that's what's actually causing the problem. KEYCTL_PKEY_* are a weird set of APIs where userspace can ask the kernel to do asymmetric key operations. It's unclear why they exist, as the same functionality is available in userspace crypto libraries. I suppose that the blamed commit, or at least part of it, will need to be reverted to keep these weird keyctls working. For the future, why doesn't iwd just use a userspace crypto library such as OpenSSL? - Eric _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel