selftests: net: fcnal-test: check if FIPS mode is enabled

[ Upstream commit d7a2fc1437f71cb058c7b11bc33dfc19e4bf277a ]

There are some MD5 tests which fail when the kernel is in FIPS mode,
since MD5 is not FIPS compliant. Add a check and only run those tests
if FIPS mode is not enabled.

Fixes: f0bee1ebb5594 ("fcnal-test: Add TCP MD5 tests")
Fixes: 5cad8bce26e01 ("fcnal-test: Add TCP MD5 tests for VRF")
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Magali Lemes <magali.lemes@canonical.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 21ca914..ee6880a 100755 (executable)
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -92,6 +92,13 @@ NSC_CMD="ip netns exec ${NSC}"
 
 which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping)
 
+# Check if FIPS mode is enabled
+if [ -f /proc/sys/crypto/fips_enabled ]; then
+       fips_enabled=`cat /proc/sys/crypto/fips_enabled`
+else
+       fips_enabled=0
+fi
+
 ################################################################################
 # utilities
 
@@ -1216,7 +1223,7 @@ ipv4_tcp_novrf()
        run_cmd nettest -d ${NSA_DEV} -r ${a}
        log_test_addr ${a} $? 1 "No server, device client, local conn"
 
-       ipv4_tcp_md5_novrf
+       [ "$fips_enabled" = "1" ] || ipv4_tcp_md5_novrf
 }
 
 ipv4_tcp_vrf()
@@ -1270,9 +1277,11 @@ ipv4_tcp_vrf()
        log_test_addr ${a} $? 1 "Global server, local connection"
 
        # run MD5 tests
-       setup_vrf_dup
-       ipv4_tcp_md5
-       cleanup_vrf_dup
+       if [ "$fips_enabled" = "0" ]; then
+               setup_vrf_dup
+               ipv4_tcp_md5
+               cleanup_vrf_dup
+       fi
 
        #
        # enable VRF global server
@@ -2772,7 +2781,7 @@ ipv6_tcp_novrf()
                log_test_addr ${a} $? 1 "No server, device client, local conn"
        done
 
-       ipv6_tcp_md5_novrf
+       [ "$fips_enabled" = "1" ] || ipv6_tcp_md5_novrf
 }
 
 ipv6_tcp_vrf()
@@ -2842,9 +2851,11 @@ ipv6_tcp_vrf()
        log_test_addr ${a} $? 1 "Global server, local connection"
 
        # run MD5 tests
-       setup_vrf_dup
-       ipv6_tcp_md5
-       cleanup_vrf_dup
+       if [ "$fips_enabled" = "0" ]; then
+               setup_vrf_dup
+               ipv6_tcp_md5
+               cleanup_vrf_dup
+       fi
 
        #
        # enable VRF global server