Files
linux/include/linux
Antony Antony c7a5899eb2 xfrm: redact SA secret with lockdown confidentiality
redact XFRM SA secret in the netlink response to xfrm_get_sa()
or dumpall sa.
Enable lockdown, confidentiality mode, at boot or at run time.

e.g. when enabled:
cat /sys/kernel/security/lockdown
none integrity [confidentiality]

ip xfrm state
src 172.16.1.200 dst 172.16.1.100
	proto esp spi 0x00000002 reqid 2 mode tunnel
	replay-window 0
	aead rfc4106(gcm(aes)) 0x0000000000000000000000000000000000000000 96

note: the aead secret is redacted.
Redacting secret is also a FIPS 140-2 requirement.

v1->v2
 - add size checks before memset calls
v2->v3
 - replace spaces with tabs for consistency
v3->v4
 - use kernel lockdown instead of a /proc setting
v4->v5
 - remove kconfig option

Reviewed-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2020-11-27 11:03:06 +01:00
..
2020-10-02 14:59:25 -07:00
2020-09-21 15:00:40 -07:00
2020-10-02 15:00:49 -07:00
2020-10-16 17:21:51 +02:00
2020-08-12 20:42:08 +02:00
2020-09-30 22:44:26 +02:00
2020-09-16 08:54:53 -05:00
2020-08-26 12:41:56 +02:00
2020-10-28 13:42:36 -04:00
2020-10-13 18:38:32 -07:00
2020-09-04 09:25:20 -07:00
2020-09-23 18:02:49 -07:00
2020-11-05 16:54:01 -08:00
2020-09-04 12:46:07 +01:00
2020-08-27 16:06:47 -04:00
2020-10-07 14:28:39 -04:00
2020-09-24 19:49:36 -07:00
2020-08-31 12:52:33 -07:00
2020-10-18 09:27:10 -07:00
2020-08-18 17:06:15 +02:00
2020-08-07 11:33:24 -07:00
2020-09-26 22:55:05 -04:00
2020-09-10 14:03:31 -07:00
2020-10-18 09:27:10 -07:00
2020-10-05 13:21:49 +02:00