From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 043B8437469 for ; Fri, 21 Aug 2026 14:43:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787323416; cv=none; b=rrDaJ9aleWNnFwmM0TPD53GzGyLd6kdtGB4vnpUaxTPi774ASehgYpWs/5o4FUpHn6+t/x+fYjxN/1vhsuqvW82a1tihb/I0BMWhf5YSqGSL9KmzRWhybmqZ8hqPAH4FmUtp2Fv2GPIpDgL491LHr1W0RGMzXamA0ErXLRFouOc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787323416; c=relaxed/simple; bh=dUjnDIh+EPPi0jNNexkxustlsejlPKjbUqBsKO4pBGo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YGkEVECHoRRzDZJvoQ9wXr/r4upxSjYftKMZt2QK+i1lTkcVLNhmL3K3RKNNOXtsEjtY5XODjsWYJ4avUR60dhN34jIMYP2K750sfex5ISnWHwFqHoesGgEEqaii4HsIs6h3GMx9M+uqQNa17v0br7huHdtx4+63RZRznvD8AD0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=I0/bGBw3; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="I0/bGBw3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787323414; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=diHx+7gEskOQcUcM4jLEzuiEx5++PzT8+hoKTy9o7GM=; b=I0/bGBw3GXk75QE5zXzKOzTGePNypm5eDFfHO/poQVhDhePywM8PJrrFmgDvMnlELVpdGO Es1mhG3xXCc738UeRSdLDEaa+tGtTaMFJez4b3V8ddXodxwN0wUyB78pLddyEnGyjhA6xT mAwF3+vOFyqYRok4E4o3ERTWElWay44= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-55-24bfmF5bMaWuH4DF_9fbzQ-1; Fri, 21 Aug 2026 10:43:32 -0400 X-MC-Unique: 24bfmF5bMaWuH4DF_9fbzQ-1 X-Mimecast-MFC-AGG-ID: 24bfmF5bMaWuH4DF_9fbzQ_1787323410 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1ABF418052CA; Fri, 21 Aug 2026 14:43:29 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.44.32.162]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7A2C53002D34; Fri, 21 Aug 2026 14:43:25 +0000 (UTC) From: Thomas Huth To: Ilya Dryomov , Alex Markuze , Viacheslav Dubeyko , Eric Biggers Cc: Viacheslav Dubeyko , ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] libceph: Re-establish the FIPS keylength check in the Ceph code Date: Fri, 21 Aug 2026 16:43:22 +0200 Message-ID: <20260821144323.776371-1-thuth@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 When the Ceph code had been updated to use the libcrypto hmac_sha256 functions instead of the "hmac(sha256)" crypto shash driver, we lost the FIPS key length check from hmac_setkey() in crypto/hmac.c. Since libcrypto won't support this FIPS check (it should be done in the calling sites instead), add the check now to the Ceph code instead to make this code more FIPS friendly again. Fixes: 27c0a7b05d13a ("libceph: Use HMAC-SHA256 library instead of crypto_shash") Signed-off-by: Thomas Huth --- net/ceph/messenger_v2.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c index 05f6eea299fc0..378493d5d7155 100644 --- a/net/ceph/messenger_v2.c +++ b/net/ceph/messenger_v2.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -721,6 +722,9 @@ static int setup_crypto(struct ceph_connection *con, return 0; /* auth_none */ } + if (fips_enabled && session_key_len < 112 / 8) + return -EKEYREJECTED; + hmac_sha256_preparekey(&con->v2.hmac_key, session_key, session_key_len); con->v2.hmac_key_set = true; -- 2.55.0