| Message ID | 20210407104307.3731826-1-liuhangbin@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [net-next] wireguard: disable in FIPS mode | expand |
diff --git a/drivers/net/wireguard/main.c b/drivers/net/wireguard/main.c index 7a7d5f1a80fc..8a9aaea7623c 100644 --- a/drivers/net/wireguard/main.c +++ b/drivers/net/wireguard/main.c @@ -12,6 +12,7 @@ #include <uapi/linux/wireguard.h> +#include <linux/fips.h> #include <linux/init.h> #include <linux/module.h> #include <linux/genetlink.h> @@ -21,6 +22,9 @@ static int __init mod_init(void) { int ret; + if (fips_enabled) + return -EOPNOTSUPP; + #ifdef DEBUG if (!wg_allowedips_selftest() || !wg_packet_counter_selftest() || !wg_ratelimiter_selftest())
As the cryptos(BLAKE2S, Curve25519, CHACHA20POLY1305) in WireGuard are not FIPS certified, the WireGuard module should be disabled in FIPS mode. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- drivers/net/wireguard/main.c | 4 ++++ 1 file changed, 4 insertions(+)