Re: [PATCH] crypto: algif_aead - Allow gcm(aes) for privileged users

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Nov 05, 2026 at 11:07:15PM -0500, Walter McKelvie wrote:
> > Is this with upstream iwd, and do you have a source code reference?
> 
> Yes. I'm using upstream iwd 3.12 with upstream ell 0.83.
> 
> The reference is in ell rather than in iwd, which is probably why your
> grep missed it.
> 
> iwd's EAP-TLS, EAP-TTLS and EAP-PEAP implementations hand the TLS
> tunnel to ell (src/eap-tls-common.c:641, l_tls_new()).  ell's TLS 1.2
> cipher suite table uses L_AEAD_CIPHER_AES_GCM for the eight
> *_WITH_AES_{128,256}_GCM_* suites:
> 
>   https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/tls-suites.c?h=0.83#n1220
>   (tls_aes128_gcm / tls_aes256_gcm, used by the suites at lines
>   1322-1425, e.g. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
> 
> That maps to the AF_ALG name "gcm(aes)" and is bound through AF_ALG:
> 
>   https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/cipher.c?h=0.83#n224
>   (aead_cipher_type_to_name(), then create_alg("aead", ...) in
>   l_aead_cipher_new(), and the bind() probe in
>   l_aead_cipher_is_supported())
> 
> When the probe fails, ell drops those suites from the ClientHello:
> 
>   https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/tls.c?h=0.83#n413
>   ("Cipher suite %s's AEAD cipher algorithm not supported by the
>   kernel")
> 
> With af_alg_restrict=1 that is what happens, and EAP authentication
> then fails against RADIUS servers that only accept GCM suites. This
> is the failure in the linked report. An affected user confirmed that
> setting af_alg_restrict=0 fixed the connection.
> 
> Everything else iwd uses through ell is already on the privileged
> allowlist, and ell has no ChaCha20-Poly1305 AEAD, so gcm(aes)
> is the only missing algorithm.

Okay, thanks.  Can you document explicitly in your commit message that
iwd can use "gcm(aes)" indirectly via libell's TLS support, despite iwd
itself never mentioning either "gcm(aes)" or L_AEAD_CIPHER_AES_GCM?
Even the iwd folks themselves apparently don't know they are depending
on AF_ALG support for this algorithm :(

You also mentioned that iwd uses "ccm(aes)".  If that's true, the
comment next to "ccm(aes)" should also be updated to say 
/* iwd, bluez */ instead of just /* bluez */.  However, libell doesn't
actually have L_AEAD_CIPHER_AES_CCM in its TLS cipher list, so I still
don't see that one.  Do you have evidence that AES-CCM is used as well,
or did you just assume that one would be the same?

- Eric