From 8a3bf3733b5822ec4c0c7182e5503482ee683891 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 18 Aug 2026 11:33:17 +0200 Subject: [PATCH] Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 Signed-off-by: Zoltan Fridrich --- 002-fips-disable-ansi_cprng.patch | 74 ------------------------------- 002-remove-ansi_cprng-test.patch | 57 ++++++++++++++++++++++++ libkcapi.spec | 8 +++- 3 files changed, 63 insertions(+), 76 deletions(-) delete mode 100644 002-fips-disable-ansi_cprng.patch create mode 100644 002-remove-ansi_cprng-test.patch diff --git a/002-fips-disable-ansi_cprng.patch b/002-fips-disable-ansi_cprng.patch deleted file mode 100644 index b7f2980..0000000 --- a/002-fips-disable-ansi_cprng.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 873842046678d109d8e382ce2e2870909876bbfe Mon Sep 17 00:00:00 2001 -From: Zoltan Fridrich -Date: Fri, 11 Aug 2023 12:20:22 +0200 -Subject: [PATCH] Disable test of obsolete ansi_cprng in FIPS mode - -Signed-off-by: Zoltan Fridrich -Signed-off-by: Stephan Mueller ---- - test/kcapi-main.c | 45 ++++++++++++++++++++++----------------------- - 1 file changed, 22 insertions(+), 23 deletions(-) - -diff --git a/test/kcapi-main.c b/test/kcapi-main.c -index 67fb53f..23fc8ed 100644 ---- a/test/kcapi-main.c -+++ b/test/kcapi-main.c -@@ -652,8 +652,6 @@ static int is_fips_mode(void) - static int auxiliary_tests(void) - { - struct kcapi_handle *handle = NULL; -- const char *ansi_cprng_name = is_fips_mode() ? "fips(ansi_cprng)" -- : "ansi_cprng"; - int ret = 0; - - if (kcapi_aead_init(&handle, "ccm(aes)", 0)) { -@@ -711,27 +709,28 @@ static int auxiliary_tests(void) - if (aux_test_rng("drbg_nopr_ctr_aes256", NULL, 0)) - ret++; - -- /* X9.31 RNG must require seed */ -- printf("X9.31 missing seeding: "); -- if (!aux_test_rng(ansi_cprng_name, NULL, 0)) -- ret++; -- /* X9.31 seed too short */ -- printf("X9.31 insufficient seeding: "); -- if (!aux_test_rng(ansi_cprng_name, -- (uint8_t *) -- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -- "\x00\x01\x02\x03\x04\x05\x06\x07\x08", 16)) -- ret++; -- /* X9.31 seed right sized short */ -- if (aux_test_rng(ansi_cprng_name, -- (uint8_t *) -- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -- "\x00\x01\x02\x03\x04\x05\x06\x07\x08", 32)) { -- printf("Error for %s: kernel module ansi_cprng present?\n", -- ansi_cprng_name); -- ret++; -+ if (!is_fips_mode()) { -+ /* X9.31 RNG must require seed */ -+ printf("X9.31 missing seeding: "); -+ if (!aux_test_rng("ansi_cprng", NULL, 0)) -+ ret++; -+ /* X9.31 seed too short */ -+ printf("X9.31 insufficient seeding: "); -+ if (!aux_test_rng("ansi_cprng", -+ (uint8_t *) -+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08", 16)) -+ ret++; -+ /* X9.31 seed right sized short */ -+ if (aux_test_rng("ansi_cprng", -+ (uint8_t *) -+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08" -+ "\x00\x01\x02\x03\x04\x05\x06\x07\x08", 32)) { -+ printf("Error for ansi_cprng: kernel module ansi_cprng present?\n"); -+ ret++; -+ } - } - - return ret; diff --git a/002-remove-ansi_cprng-test.patch b/002-remove-ansi_cprng-test.patch new file mode 100644 index 0000000..e6219ad --- /dev/null +++ b/002-remove-ansi_cprng-test.patch @@ -0,0 +1,57 @@ +diff --git a/test/kcapi-main.c b/test/kcapi-main.c +index 67fb53f..7556796 100644 +--- a/test/kcapi-main.c ++++ b/test/kcapi-main.c +@@ -637,23 +637,9 @@ static int aux_test_rng(const char *name, const uint8_t *seed, uint32_t seedlen) + return 0; + } + +-static int is_fips_mode(void) +-{ +- char c; +- FILE *f = fopen("/proc/sys/crypto/fips_enabled", "r"); +- if (!f) +- return 0; +- if (fread(&c, 1, 1, f) < 1) +- c = '0'; +- fclose(f); +- return c == '1'; +-} +- + static int auxiliary_tests(void) + { + struct kcapi_handle *handle = NULL; +- const char *ansi_cprng_name = is_fips_mode() ? "fips(ansi_cprng)" +- : "ansi_cprng"; + int ret = 0; + + if (kcapi_aead_init(&handle, "ccm(aes)", 0)) { +@@ -711,28 +697,5 @@ static int auxiliary_tests(void) + if (aux_test_rng("drbg_nopr_ctr_aes256", NULL, 0)) + ret++; + +- /* X9.31 RNG must require seed */ +- printf("X9.31 missing seeding: "); +- if (!aux_test_rng(ansi_cprng_name, NULL, 0)) +- ret++; +- /* X9.31 seed too short */ +- printf("X9.31 insufficient seeding: "); +- if (!aux_test_rng(ansi_cprng_name, +- (uint8_t *) +- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" +- "\x00\x01\x02\x03\x04\x05\x06\x07\x08", 16)) +- ret++; +- /* X9.31 seed right sized short */ +- if (aux_test_rng(ansi_cprng_name, +- (uint8_t *) +- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" +- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" +- "\x00\x01\x02\x03\x04\x05\x06\x07\x08" +- "\x00\x01\x02\x03\x04\x05\x06\x07\x08", 32)) { +- printf("Error for %s: kernel module ansi_cprng present?\n", +- ansi_cprng_name); +- ret++; +- } +- + return ret; + } diff --git a/libkcapi.spec b/libkcapi.spec index 4b53078..d525cbf 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -123,7 +123,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 2%{?dist} +Release: 3%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD-3-Clause OR GPL-2.0-only @@ -134,7 +134,7 @@ Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh Patch1: 001-tests-kernel-version.patch -Patch2: 002-fips-disable-ansi_cprng.patch +Patch2: 002-remove-ansi_cprng-test.patch Patch3: 003-zeroize-hasher.patch Patch4: 004-hasher-target-option.patch Patch5: 005-fips-mode-tests.patch @@ -520,6 +520,10 @@ popd %changelog +* Tue Aug 18 2026 Zoltan Fridrich - 1.4.0-3 +- Remove ansi_cprng test as new kernels don't support it + Resolves: RHEL-242707 + * Fri Dec 01 2023 Zoltan Fridrich - 1.4.0-2 - Backport fixes for kcapi-hasher target option Related: RHEL-15298