diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2024-03-11 12:09:25 +0000 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2024-03-19 20:17:12 +0000 |
| commit | e503fc55acffccac5d2755633e7a48262e8edd9b (patch) | |
| tree | 95fc5b0d026bce08cbf70ce1a0df4d5b0173325b /crypto | |
| parent | eac57306d89facbcacdb814833b57a8c9ed18d62 (diff) | |
crypto: query gcrypt for cipher availability
Just because a cipher is defined in the gcrypt header file, does not
imply that it can be used. Distros can filter the list of ciphers when
building gcrypt. For example, RHEL-9 disables the SM4 cipher. It is
also possible that running in FIPS mode might dynamically change what
ciphers are available at runtime.
qcrypto_cipher_supports must therefore query gcrypt directly to check
for cipher availability.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/cipher-gcrypt.c.inc | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/crypto/cipher-gcrypt.c.inc b/crypto/cipher-gcrypt.c.inc index 6b82280f90..4a8314746d 100644 --- a/crypto/cipher-gcrypt.c.inc +++ b/crypto/cipher-gcrypt.c.inc @@ -93,6 +93,11 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg, return false; } + if (gcry_cipher_algo_info(qcrypto_cipher_alg_to_gcry_alg(alg), + GCRYCTL_TEST_ALGO, NULL, NULL) != 0) { + return false; + } + switch (mode) { case QCRYPTO_CIPHER_MODE_ECB: case QCRYPTO_CIPHER_MODE_CBC: |