Re: [PATCH 1/2] wifi: iwlwifi: enable MFP_CAPABLE in FIPS mode

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

Hi Johannes,

Sorry for the delay.

Regarding the requested information, we can only say that our customers
are US government agencies and US government contractors, and these
entities are required to use FIPS.

From internal discussions, we understand and accept the firmware limitation
with robust action frames (CSA, Block-Ack) not being integrity-protected.
But these users are primarily concerned with the data encryption paths
being FIPS-compliant, which mac80211 software crypto already provided.
And they would accept the known management frame integrity gap as a
documented trade-off to restore WiFi connectivity.

Since no firmware modification might be expected to address this, 
would it be acceptable to introduce an opt-in exception (e.g. a kernel
parameter) that re-enables MFP with a clear warning, so users who
understand the limitation can explicitly choose connectivity over
strict compliance?
The default behavior would remain exactly as you implemented it.

For example, something like this:

   if (!fips_enabled) {
        ieee80211_hw_set(hw, MFP_CAPABLE);
  +} else if (fips_exception & FIPS_EXCEPTION_IWLWIFI_MFP) {
  +     ieee80211_hw_set(hw, MFP_CAPABLE);
  +     IWL_WARN(mvm, "FIPS: MFP enabled with known firmware limitation\n");
   }

If you think this approach could be acceptable, I can prepare a following
patch series with a concrete proposal for your review.

Thanks

Best regards,
José Ignacio