[PATCH 0/2] wifi: iwlwifi: Fix WiFi operation in FIPS mode

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

This series re-enables WiFi connectivity in FIPS mode for iwlwifi by
allowing Management Frame Protection (MFP/802.11w) to work with mac80211
software crypto.

Currently, iwlwifi connections fail in FIPS mode because commit
0636800c8ee1 (("wifi: iwlwifi: disable certain features for fips_enabled")
disabled MFP_CAPABLE when fips_enabled=1. The testing shows that MFP works
correctly in FIPS mode when mac80211 software crypto handles IGTK encryption
/decryption using FIPS-approved AES-CMAC/GMAC algorithms.

I think the original concern that "MFP since some frames need to be handled
in firmware" can be avoided for normal STA operation. The firmware-offload
requirement appears to apply specifically to features like WoWLAN and beacon
protection, which remain correctly disabled. AFAIK, for standard client
connections, management frames are processed only in software and mac80211
provides complete IGTK handling.

Patch 1 re-enables MFP_CAPABLE for iwlwifi to allow basic WiFi client
operation in FIPS mode. Patch 2 reduces a misleading warning message that
appears during normal FIPS operation to debug level - the warning actually
confirms that frames are not processed by firmware and are correctly handled
by software crypto instead.

Testing on Intel WiFi 6E AX210 with fips=1:

Before:
  # cat /proc/sys/crypto/fips_enabled
  1
  # iw phy phy0 info | grep -A 10 "Cipher"
  Supported Ciphers:
      * CCMP-128 (00-0f-ac:4)
      * CCMP-256 (00-0f-ac:10)
      * GCMP-128 (00-0f-ac:8)
      * GCMP-256 (00-0f-ac:9)
  # nmcli connection up SSID
  Error: Connection activation failed

After:
  # cat /proc/sys/crypto/fips_enabled
  1
  # iw phy phy0 info | grep -A 10 "Cipher"
  Supported Ciphers:
      * CCMP-128 (00-0f-ac:4)
      * CCMP-256 (00-0f-ac:10)
      * GCMP-128 (00-0f-ac:8)
      * GCMP-256 (00-0f-ac:9)
      * CMAC (00-0f-ac:6)
      * CMAC-256 (00-0f-ac:13)
      * GMAC-128 (00-0f-ac:11)
      * GMAC-256 (00-0f-ac:12)
  # nmcli connection up SSID
  Connection successfully activated
  # iw dev wlp7s0 station dump | grep MFP
  MFP:        yes

Jose Ignacio Tornos Martinez (2):
  wifi: iwlwifi: enable MFP_CAPABLE in FIPS mode
  wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode

--
2.47.1