Just because a cipher is defined in the gcrypt header file, does not
imply that it can be used. Distros can filter the list of ciphers when
building gcrypt. For example, RHEL-9 disables the SM4 cipher. It is
also possible that running in FIPS mode might dynamically change what
ciphers are available at runtime.

qcrypto_cipher_supports must therefore query gcrypt directly to check
for cipher availability.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/cipher-gcrypt.c.inc | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crypto/cipher-gcrypt.c.inc b/crypto/cipher-gcrypt.c.inc
index 6b82280f90..4a8314746d 100644
--- a/crypto/cipher-gcrypt.c.inc
+++ b/crypto/cipher-gcrypt.c.inc
@@ -93,6 +93,11 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
         return false;
     }
 
+    if (gcry_cipher_algo_info(qcrypto_cipher_alg_to_gcry_alg(alg),
+                              GCRYCTL_TEST_ALGO, NULL, NULL) != 0) {
+        return false;
+    }
+
     switch (mode) {
     case QCRYPTO_CIPHER_MODE_ECB:
     case QCRYPTO_CIPHER_MODE_CBC:
-- 
2.43.0

On 11/03/2024 13.19, Daniel P. Berrangé wrote:
> Just because a cipher is defined in the gcrypt header file, does not
> imply that it can be used. Distros can filter the list of ciphers when
> building gcrypt. For example, RHEL-9 disables the SM4 cipher. It is
> also possible that running in FIPS mode might dynamically change what
> ciphers are available at runtime.
> 
> qcrypto_cipher_supports must therefore query gcrypt directly to check
> for cipher availability.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   crypto/cipher-gcrypt.c.inc | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/crypto/cipher-gcrypt.c.inc b/crypto/cipher-gcrypt.c.inc
> index 6b82280f90..4a8314746d 100644
> --- a/crypto/cipher-gcrypt.c.inc
> +++ b/crypto/cipher-gcrypt.c.inc
> @@ -93,6 +93,11 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
>           return false;
>       }
>   
> +    if (gcry_cipher_algo_info(qcrypto_cipher_alg_to_gcry_alg(alg),
> +                              GCRYCTL_TEST_ALGO, NULL, NULL) != 0) {
> +        return false;
> +    }
> +
>       switch (mode) {
>       case QCRYPTO_CIPHER_MODE_ECB:
>       case QCRYPTO_CIPHER_MODE_CBC:

Reviewed-by: Thomas Huth <thuth@redhat.com>